Malicious code in publish-poc-test3 (npm)

Source: amazon-inspector 4001a75b24abfa181a10e5d40931194f254304fcf5fda554488d3c242cc5db85 The package's postinstall lifecycle script creates a temporary directory, writes a fabricated package.json whose name is 'publish-poc-found-' random suffix derived via 'openssl rand -hex 2', and then invokes...