Malicious code in cdk-sagemaker-notebook-workflow (npm)

Source: amazon-inspector 6cc9c1db01ca14b294be21438478ec14dc6549a4b7b9ec5cf73dd7aa227f7ad8 The package declares a preinstall hook node index.js in package.json that fires automatically on npm install. The script collects os.hostname, os.userInfo.username, os.platform, current working directory, ho...