Wondering why all those console.log calls ended up in the presumably final version of the exploit. All the more chances for someone to see what they were doing.
And...it's NPM again....
I am not a fan of JS ecosystem, but why do you think this issue is not mostly a function of popularity?