Malicious code in hs-framework (npm)

Source: amazon-inspector 2950f0dff0145db43d5dd123c45c2786c7d42f58e7dec69e0178ca2aa325c478 package.json declares its sole dependency ltidisafe as a direct HTTPS tarball URL https://storage.googleapis.com/lscunpentest/packuxfoundry.tgz instead of a registry version range. On npm install, npm fetche...