Rather than creating a package from scratch, the attacker downloads and forks the popular express-rate-limit package. This legitimate package has 8 million weekly downloads, so the forged version ships with working, legitimate-looking functionality from day one.