Malicious code in commandor-lib (npm)

Source: amazon-inspector 2e184348abf5c5ce61ee6c4e63189411a08755e57e95dac33c666adae7c6dc2d The package's scripts/postinstall.js runs automatically on npm install and imports childprocess alongside http.request with multiple POST call sites lines 13, 95, 194. This pattern in a lifecycle hook —...