Malicious code in react-native-bright-sdk (npm)

Source: amazon-inspector 4208eebeabe05114e68e0b4abf11c9ff176594200c28400fe5c82deb3a5c8f55 The package declares a preinstall lifecycle hook that executes canary.js on npm install. The script collects os.hostname and an install timestamp, base64-encodes the JSON payload, and transmits it via HTTPS...