I guess you have to watch the 20 minute video massive eye roll But skimming the video to places where there might actually be signal, there is at least one liv

I guess you have to watch the 20 minute video massive eye roll But skimming the video to places where there might actually be signal, there is at least one live npm example where there is a call to an external url and then a pipe to sh. This is pretty clearly malicious yet tools like Snyk and Dependabot list it as clean. Might be worth someone running through the video to pull out the examples given so people benefit from this.