Malicious code in devplatform-vite-plugin-preserve-css-modules (npm)

Source: amazon-inspector 0781a29416d218a9767f37894e3ad9a851110f50693a4bcb1ab6bd168e1f6feb On require of the package, index.js loads loader.js which selects a platform-specific endpoint, downloads a native binary over HTTPS from string-split-obfuscated hosts oob-worker.cf100-416.workers.dev,...