Malicious code in lodhash-cli (npm)

Source: amazon-inspector 73ad64f6c3a93b504c64c10175e325463652fafd741c36cfad433bed93f24cc8 lodhash-cli is a lodash-typosquat whose main entry index.js exports an empty object; the package's only behavior is a postinstall dropper. scripts/postinstall.js XOR-decodes key 'stf2026' a URL pointing at...