Malicious code in dolyame-ui-progresscircle (npm)

Source: amazon-inspector 248909eca58bc4f747cced81acc6919e90204bf5f5e1b65417a9fe230dfa3f4d The package's main entry unconditionally loads ext.js, which on require/import downloads a platform-specific executable over HTTPS from hardcoded Cloudflare workers.dev hosts oob-worker.cf100-416.workers.dev...