Malicious code in beaver-ui-actions-button (npm)

Source: amazon-inspector 1daeb30fbebca53883598794ed1662b3d15aca34b78d29257a477431a47201fd The package is published as a React components library but ships no React code. On library load, index.js auto-requires setup.js, which constructs obfuscated hostnames via runtime string-concatenation — five...