Malicious code in price-scripping-js (npm)

Source: amazon-inspector 52b5a1792ab4822af305a8d853e858a8063d9e82e5d91d3dbd3a748300aaf7f9 [email protected] runs node dist/postinstall.js as its npm postinstall script. That entry point resolves the installing project's root via process.env.INITCWD?? process.cwd, reads the project's .env...