[vitamark]

anything except that it's malware installed via npm

[Retr0id]

As you can see here, they've already switched it out for a different command, likely due to incident responders over-indexing on npm as an IOC.

https://news.ycombinator.com/item?id=48503258