How npm install scripts can be weaponized: A real-world example of a harmful npm package

An analysis of an obfuscated JavaScript malware package