Moment at 3:59 in A single PR just hijacked the NPM registry... by Fireship.
On infected local machines, a background process checked the validity of stolen tokens every 60 seconds; if the token expired, the malware deliberately deleted the user's root directory
Saved by AironD.