Isn't the intended behaviour of original comment checking the node_modules folder for the "infected" string.