Malicious code in clover-codelab-remote-pay-cloud (npm)

Source: amazon-inspector 071fbdd6b5ca7cbb0fc696f5abf7a47be3783dd970ca5594cb415e67579f2b15 The package declares a postinstall hook that runs index.js on npm install. index.js collects the OS username, current working directory, hostname, and non-internal IPv4 address via os.userInfo, process.cwd,...