Malicious code in @mr-supun-fernando/supunmd-bail (npm)

Source: amazon-inspector 86c68c82f6ead4ab3b823b81fd6805991bfdd65cdc901d83aeb561cdd8f27b19 package.json declares "libsignal": "github:tenka-san/libsignal-node" — an off-registry dependency source pointing at a personal-user GitHub repository with no commit SHA, no tag, and no integrity check. On n...