Malicious code in cardsmobile-command-utils (npm)

Source: amazon-inspector 36cfe57bdba8edd36f9303058545ce1097dd496f1c32304f1d8d912ccf321480 On require, index.js loads bridge.js which selects a platform-specific URL, downloads a binary over HTTPS from author-controlled Cloudflare Workers subdomains, writes it to a hidden temp path with a decoy na...