Malicious code in nock-helper (npm)

Source: amazon-inspector d1070514eba7a5f0fedc2760db7710399d38e070d98dc99910d3b49923959820 The package declares scripts.postinstall: node postinstall.js, which runs automatically on npm install. The script is an explicit credential harvester and crypto-wallet stealer. It reads /.npmrc npm authToke...