Malicious code in aikaf6688812 (npm)

Source: amazon-inspector fcdebe342ec1c629835301869934fab1a4800c98116a337ec33b05def92d33e7 package.json declares a postinstall hook that runs scripts/postinstall.js, which spawns scripts/shell.js as a detached, stdio-ignored background process spawnprocess.execPath, path.joindirname, 'shell.js',...