Malicious code in setup-codex (npm)

Source: amazon-inspector 957e8b8d535ccc5e5d7e84e99a51695f7a50a4417bfca5f3582ae2817ca75846 The package's lib/report.js requires childprocess, fs, https, and os at the top of the module and constructs an HTTPS POST to a hardcoded destination at hooks.zapier.com see line 12. The report body includes...