Malicious code in @ppa-web-components/ppa-navigation (npm)

Source: amazon-inspector c88c344e72bb7cf5ae6f5e6185a1024caf8b96bce96584d448609ab78cd894af The package is a shim whose only functional payload is a beacon. package.json declares a postinstall that runs node beacon.cjs, and index.js additionally invokes require'./beacon.cjs'.fire on load, so the...