Malicious code in @ppa-web-components/ppa-hotel-collection (npm)

Source: amazon-inspector e442008a433c1edbe8fb25f9b47dd3123f5664672c3901167fc9d3add8a6bd6e @ppa-web-components/[email protected] is a stub package whose only functional code is a callback beacon. The package.json declares scripts.postinstall: "node beacon.cjs", and the same beacon.cjs is...