Malicious code in @lilsccott6x9/devpipe-connector (npm)

Source: amazon-inspector e8615ec2381e2fc36518a5f991f1a132ffe8c86fc458a7072585bb950644eb1f The package's postinstall lifecycle hook package.json declares postinstall=node scripts/setup.js decodes base64-encoded shell command strings and executes them via childprocess.execSync. The setup.js script...