Malicious code in gugodapis (npm)

Dropper. At run time the package downloads a Windows batch file from a remote URL into the system temporary directory and executes it with childprocess.exec. The payload is fetched, not shipped, so the code that runs is controlled by the remote host. Version examined: 1.0.0; tarball SHA-256...