Malicious code in devplatform-react-mcp (npm)

Source: amazon-inspector 21349fd06b973a43dd3b8e7bbf1ec9c726d71fba81e1656410d718a3ef4b7e7e [email protected] is a dropper disguised as a React MCP SDK. On require, index.js loads helpers.js which assembles three Cloudflare Workers hostnames oob-worker.cf99-9b3.workers.dev,...