Malicious code in chalkdevx (npm)

Source: amazon-inspector 3e6c8e970ad81ccd02b4725232cbd0d145a20f08e42983097229563e35cac8ad package.json declares a postinstall hook that runs.init.js on npm install. The script enumerates 65 credential and CI environment variables NPMTOKEN, GITHUBTOKEN, AWSSECRETACCESSKEY, STRIPE, DOCKER, cloud...