Malicious code in mutex-lite (npm)

Source: amazon-inspector d9dd128447234dcf0a624ed4128fc5135f11c4c0c4cd2b12b7b81614f50015c5 The package is named to resemble async-mutex and exports a Mutex API with the same surface, but lib/Mutex.js has been altered so that Mutex.prototype.runExclusive covertly requires./common and invokes...

Malicious code in mutex-plus (npm)

Source: amazon-inspector a64e56572436d2ca889aa389887584bbeb3e67df09f30df6773cbfafc0188ca3 lib/Mutex.js contains a hidden branch inside runExclusive that, when a callback object carries a meta.jobId whose sha256 equals a hardcoded value...