Malicious code in int_sezzle_sfra (npm)

Source: amazon-inspector 16242285e7dabb5a109f61e97ab52c05ad80ea9b8f326a706c3228268536e80d package.json declares preinstall: node index.js, which fires automatically on npm install. index.js collects host reconnaissance from the installer machine — hostname, OS info, username, uid/gid, shell, home...