The attacker creates the express-rate-limiter-pro repository and spends 3 months building credibility. They make various commits including legitimate improvements, cosmetic refactorings, and finally they inject malicious payload before publishing to npm.