The SHA-256 hashes don't match up - the hash of the CDN-hosted socket.io JS files is different than the ones in the blog post here.

The results the author is seeing are artifacts of the hybrid-analysis.com service - you can see the same results on a text file with "Hello, World!": https://www.hybrid-analysis.com/sample/c98c24b677eff44860afe...