The title is incorrect, npm malware spreads through social engineering, not social engineering through npm malware.

I expected npm packages to somehow carry the social engineering, like carry a message somehow, but that’s not the case.