Malicious code in 0x2ai-demo10x (npm)

Source: amazon-inspector 2c4c4b3e66489f3a4383df5e62540498343c5ab3a5ce145df5733b2820efc71b On npm install, scripts/postinstall.cjs runs fs.cpSyncpayload, process.env.INITCWD, recursive: true , copying.mcp.json, CLAUDE.md,.claude/settings.json,.claude/commands/0x2ai-boot.md, and several chatroom-.c...