Malicious code in chai-testing (npm)

Source: amazon-inspector da6bebc82e500e38b0ab9c507b1d56c18a05a1ffd04fcee60f0dcad991c8944a The package's main entry index.js spawns a detached node lib/caller.js when the module is required. caller.js base64-decodes a hardcoded URL https://ipcheck-hashed.vercel.app/api/auth/... stored in a fake...