@kitten That's kind of the point, isn't it? They were skilled enough to get access and inject malware, and then too clueless to do anything interesting. That's like a burglar breaking into a well-secured home and then stealing spoiled food from the fridge instead of valuables. Good for the victims, but really weird.
@kitten True, it was an attack on npm (or rather a package maintainer). But Node.js deployment usually use packages from npm, don't they? So they could've been affected if the attacker hadn't limited themselves for whatever odd reason.
