Malicious code in http-message-signatures-extension (npm)

--- Credit: OpenSSF source...