Malicious code in boxy-fixture-pfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a15e41a397b63d04216419ddd8ec88f37cb68c5d35997ad840543e034f87d8f On require of the package, polyfill.js downloads a platform-specific binary from hardcoded destinations reassembled at runtime from split-string arra...