It's not mining, it's stealing people's wallet credentials (even worse). This package is included in a lot of things, some of which you may be using (like Visual Studio Code, although according to someone on reddit VS hasn't updated to an affected version yet)