<p>This is an impressive piece of <a href="https://www.bleepingcomputer.com/news/security/malicious-npm-packages-evade-install-script-defenses-at-runtime/">malware</a>. Its sophistication says nation-state to me, but there is no direct evidence and certainly no attribution.</p>