Fake LinkedIn recruiters hide a backdoor that fires on npm install

A recruiter messages a software developer on LinkedIn about a lead-engineer job. She sends a GitHub project and asks him to look at a bug.