> A large number of corrupted packages use names related to game cheats, free resources, and social media platforms, such as "free-tiktok-followers" and "free-xbox-codes," to entice users to click the links and direct them to multiple well-designed phishing webpages.
So just because the spammers are using the TikTok brand/name in their spam (also mentioned is "xbox" but they didn't use the Microsoft logo), they used THAT as the image? Not the NPM logo or something much more relevant? I know it's minor, but that rubs me the wrong way as very "sus" and clickbait for when the article is used on social sharing sites and they most likely pick that image as the article open graph image. You also know it's most likely for clickbait because the avg person is much more likely to click some link with the TikTok logo and "phishing" in the title, vs some NPM logo that they may not even know.