Looks like a very sophisticated operation, and I feel for the maintainer who had his machine compromised.

The next incarnation of this, I worry, is that the malware hibernates somehow (e.g., if (Date.now() < 1776188434046) { exit(); }) to maximize the damage.