Why is npm still not blocked by every OS on earth is beyond me. These guys will never learn.

Nothing to do with nom itself. This sort of scam would have worked with many different technologies, even a Makefile.