Malicious code in neverthrow-core (npm)

Source: amazon-inspector da6f9496a578c672b465944e85c471edd19ce837ec7693d472d6c4a3ea3733a7 [email protected] is a typosquat of the popular neverthrow library. Its package.json declares a preinstall script node -e "require'./dist/index.cjs.js'.bcryptInstall" that auto-runs on every npm install...