Yeah lots of weird emphasis on things a human wouldn't care about. And emphasis on what it isn't, rather than what it is. It's not Y, it's X. And there are two files!!!
Tinfoil hat theory - the "malware" and the blog post are written by the same LLM agent, intended only to drive views to a blog rather than accomplish anything malicious.
It uses the LICENSE file as a lock. Before anything else, it reads the package's own LICENSE file and looks for a line that has no business being in a licence:
zzril · · focus · HN ↗
[deleted] · · focus · HN ↗
[deleted]
mavamaarten · · focus · HN ↗
fwip · · focus · HN ↗
phyzome · · focus · HN ↗
a_t48 · · focus · HN ↗
mmmlinux · · focus · HN ↗