I agree with this take, but it sounds like Funnull acquired the entirety of the project, so they could have published the malware through NPM as well.