Malicious code in @thebros/create-benjamin (npm)

Source: amazon-inspector 53fb816939bb505cdabc374418983428298b09a29e5789033943301642b8b156 The package tarball ships a .env file containing a live-looking OpenAI API key OPENAIAPIKEY=sk-proj-.... The CLI entry point bin/index.js calls import "dotenv/config" at line 3, which auto-loads that .env fr...