Malicious code in govapkg (PyPI)

Source: amazon-inspector 6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf govapkg presents itself as a client for pkg.go.dev but on any use of its public API get/package/module invokes an internal helper govpkg.internal.normalizeHelper that base64-decodes a hidden URL to...