Malicious code in spf-analytics (npm)

Source: amazon-inspector 8dece44c5ce884af66714dbff1f022e0345e860d0090cb7bcb30fd7b352cdd77 index.js is a heavily obfuscated browser script obfuscator.io-style string-array + rotation advertised for inclusion via unpkg on Shopify-style storefronts. At runtime it listens for the 'gokwikevents' windo...