Malicious code in @ks-video/kwai-player-web (npm)

Source: amazon-inspector 189f106b356a246462f37d1199e1be9191a00724014f74d1ac2a39c94c5a8222 On npm install, the package's postinstall hook runs scripts/telemetry.js, which collects installer-side reconnaissance — os.hostname, os.userInfo.username, current working directory, all network interface...