Malicious code in envfile-sync (npm)

Source: amazon-inspector 533d78538183c16b774f6e5783cc1059558ca712fd129da9666361088485e055 Package name is 'envfile-sync' but every user-facing artifact README title, bin name, homepage, repository, bugs URL, badges, keywords, CHANGELOG brands the package as 'envsync', a lookalike of an unrelated...