pgserve 1.1.11 through 1.1.13 are compromised, and the code is surprisingly clean

Supply chain attacks are having a moment. The postinstall script is a 41KB credential stealer. What's interesting is there's no obfuscation at all. No eval, no atob, no curl piped to shell. Just well written javascript using standard node APIs. require('https'), execSync, fs.readFileSync, crypto.pu