Hacker News Reader

So as I read it this is ransomware that was built using nodejs... not a compromised npm package or anything like that. Is that right?

That's what I took away from the article as well. It's installed via a VBScript file.

Edit: I'm also not able to find any other record of it (yet). Everything links to the OP link or analysis on the OP link.