[paradite]

Reply to your npm edit: How do you know it is a Chinese server? it seems to be masked:

https://www.whois.com/whois/hacktask.net

[eropple]

http://hacktask.net/ shows a "we'll be right back" message in Chinese. It could be misdirection, but I'm not exactly doing forensic analysis here.