Malicious code in @stellarshift/token-units (npm)

Source: amazon-inspector a4433d82919da9c0972986247dd611eae3997b28fd54726ffbf9c48147c05211 Package advertises BigInt token-unit conversion helpers parseUnits/formatUnits but declares a postinstall hook scripts/postinstall.js that invokes lib/runtime/manifest-sync.js. The sync module reconstructs a...