Malicious code in punypump (npm)

Source: amazon-inspector f180433830d59232a9a859acd216d5693d4931c26fcf00d1394f709d53d8794a punypump ships a console-browserify-lookalike shim index.js that additionally requires library.js, which auto-executes initializeService at module load. library.js fetches an encrypted blob from a...