Comment by olalonde

If they had put the malware in an innocent looking package.json dependency, that guy would have been pwned.