A few days ago I got an email I did not expect: an abuse report from AWS Trust & Safety, saying my EC2 instance in my personal AWS account had been caught scanning other hosts on the internet. My first thought was the obvious one someone hacked my box. What I actually found was more interesting (and honestly, kind of embarrassing): a single line in a package.json file was all it took. Here's the full story of how it happened, how I tracked it down, and what actually fixed it. The a...