The what happened section mentions the addition of the `setup.mjs` and `Math_Symbol.js`, along with a change in `package.json` to add `"preinstall": "node setup.mjs"`, so presumably checking for any of those would be a good indication to check further.
For example:
find . -type f | grep -P "/Math_Symbol\.js$"
Crucially, Math_Symbol.js that is almost 800KB, not the innocent 1KB one from regenerate-unicode-properties
when i was searching i got a heartattack when i saw Math_Symbol.js. Thankfully my agent was able to figure it out.