Malicious code in secretkey-2fa (npm)

Source: amazon-inspector aeed1d38c9d76ae5e5f6657f1935bfd276c102c5d245b0992f6b57e5855a24cd Package presents itself as a zero-dependency TOTP library but its postinstall hook node lib/core.js and its advertised validateSecret API both trigger a stealer pipeline in lib/core.js. The script reads...