Malicious code in @ppa-web-components/ppa-headerfooter (npm)

Source: amazon-inspector 32234bc8ba0c918d154d680b15a1bcb7ae6f6b7d20365c02095842b84e245dce The package ships a beacon.cjs script wired as both the postinstall lifecycle hook node beacon.cjs and a require-time side effect from index.js. On install and on require, the beacon POSTs installer...