Malicious code in poly-price-node (npm)

Source: amazon-inspector 219fd8bc805a260cc62a5a3f9d524f9bb69ba2f8c5ae65e9a13e64514fdd0cf6 [email protected] advertises itself as a crypto-price fetcher but its package.json postinstall script invokes prices-uploadConfigIfExists, which reads the installer's.env file from INITCWD/cwd, parses it...