Hacker News Reader

anything except that it's malware installed via npm

As you can see here, they've already switched it out for a different command, likely due to incident responders over-indexing on npm as an IOC.