Comment by dpacmittal

So much setup but they couldn't upload the malicious code as an npm package. Real noob mistake.