Malicious code in @arbocollab/arbo-web-people (npm)

Source: amazon-inspector 3f007c3da95aa64e4c2ed5b51b736900ddc444499f2f678d749603fab516a0c3 The published tarball ships npmjs.npmrc containing a live npm-prefixed authToken for registry.npmjs.org scoped to @arbocollab. package.json declares "files": "" and .npmignore does not exclude npmjs.npmrc, s...