Is it his code to inject a backdoor in?

As another commenter said[0], this is malicious code and THAT is against the ToS of npm[1].

[0] https://news.ycombinator.com/item?id=29865977 [1] https://docs.npmjs.com/policies/open-source-terms#:~:text=Co...