Another peculiarity discovered is that the operator hardcoded the recovery phrase of their own cryptocurrency wallet. The researchers say that the only reason for this is that the threat actor did not want the malware to steal it during the test stage.

Wait, what?

Is this the same from a few days ago or the same? Hard to keep track.

is this like the second or third npm vulberability in a few months?

Didn't they add a new security measure just a week ago that now requires additional manual verification from the developer before a new version is distributed by npm?