Malicious code in checkout-resend-pos-order-sms-am (npm)

Source: amazon-inspector 67d2c64d2c4df678c1c10b1ca9d9f386e8fd6dd9afe0cb804b11b9dff736ab11 On require of this package, index.js loads polyfill.js which reconstructs attacker-controlled hostnames via array-join concatenation e.g. 'oob-worker.cf10x-.workers.dev' variants and issues an https.get to...