Malicious code in @xiaohhhh1/canvas-agent (npm)

Source: amazon-inspector 40162697638de6a974c2f7408ccf190f6d5b5f7ea82e5e52bbc9cb2a013fab08 On starting the package's bin, the agent opens an outbound WebSocket to wss://canvas.xiaohhhh1.com/api/agent-relay and forwards inbound relay messages as authenticated HTTP requests to its own local server,...