I received a fake job offer. The NPM package was a full info-stealer (aydinnyunus.github.io)