Malicious code in js-price-client-node (npm)

Source: amazon-inspector 763a44df6481ee1948ff9fda0b3997a93001acb138b7bbcba1787c3f2f8699f2 On npm install, the package's postinstall script invokes prices in dist/index.js, which resolves the consumer's project root via process.env.INITCWD?? process.cwd, reads .env with fs.readFileSync, parses it...