Malicious code in @public-for-cdao/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d844c4af5615aa5e7eb8470e79d2e95b841e91a8a23df81bafdb56f656b0111 @public-for-cdao/[email protected] is a high-version public squat of a presumed private @cdao/api scope index.js exports name '@cdao/api'; package...

MAL-2026-5968 Malicious code in cryptodao-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5323b2fc30e7603b402729f45345a9c3eb4af8361acaca5d035cc51f9e660cea package.json declares postinstall: node recon.js, which fires automatically on npm install. recon.js enumerates installer-side secrets —...