They claim to be a fix for a legitimate Python module named “bitcoinlib ... “The malicious content of that library was detected by the package contributors and the comments were deleted ...

the backdoor was found in a Python module, and not an npm (JavaScript) package. The module's name is SSH Decorator (ssh-decorate), developed by Israeli developer Uri Goren, a library for handling ...