Malicious code in @stellarshift/chain-metadata (npm)

Source: amazon-inspector 932d9a57667edad733439fadfc1754573429369cb8e65fe094c7bed1ed81c5e6 The package's postinstall lifecycle script fetches and executes arbitrary code from a remote URL that is stored XOR-encoded in endpoint-registry.json and decoded at runtime by config-resolver.js encoding tag...