Malicious code in @assetshop/verify-cli (npm)

Source: amazon-inspector 7cace01fe47bda782a3a3af79a03154284b0e58f811cf19a63942a02aa5f7342 On npm install, the package's preinstall hook executes index.js, which collects installer identity and host information — whoami via execSync, os.hostname, os.platform, os.arch, process.cwd, os.homedir, and...