Malicious code in npm-builderio-qwik-poc (npm)

Source: amazon-inspector 11a743cdce28dd141d636ff13baaee44df53fbaaed17efdc5a7380281b7097e1 The package's main entry index.js is a working browser exploit, not a library. When loaded in a DOM context, it creates a hidden iframe pointing at www.pendo.io?builder.frameEditing=true, then sprays...