Malicious code in message-compiler (npm)

Source: amazon-inspector f7469b2a666f71db1dd06fd00d6ae630becf97ad6854ff5c8938d2adcb5c8417 The package declares scripts.preinstall = 'node vishu.js', which runs automatically on npm install. vishu.js resolves the installer's public IP via api.ipify.org, reads CI-related environment variables CI,...