Malicious code in twapfetch (npm)

Source: amazon-inspector c319f6606c9407d69fa80de43ddc3b133cba284d9356a27cc12d37b3de036b3f [email protected] ships a postinstall script scripts/install-check.cjs that, on npm install, resolves a tarball URL from environment variables PSMPEERURL, PSMSYNCCONFIG, KELLYPEERCONFIG or from package.json's...