Oh, this is interesting. So the HotPockets NPM wasn’t the end of it, there are many more malicious NPM packages out there.
20180608/https://www.twilio.com/blog/2017/08/find-projects-infected-by-malicious-npm-packages.html
Fraudulent NPM packages
2018-06-07