How a fake client's project tried to hack my machine with RCE

A LinkedIn pitch, a project zip, and a remote-code-execution backdoor that fires on npm install. A real malware breakdown