Malicious code in @selfpentest/eslint-pentest-plugin (npm)

Source: amazon-inspector f338876601180482b20a42fbd799b9d4e1b059bf7d733b5db448f7fc6d3455ff Package presents itself as an ESLint plugin but the exported plugin object is an empty shell. index.js unconditionally invokes a steal routine at top level, so any require of the package including ESLint...