This is an impressive piece of malware. Its sophistication says nation-state to me, but there is no direct evidence and certainly no attribution.
Schneier on Security
Malicious npm Packages That Evade Defenses
Shown as published in the source's RSS feed. IndiaAIFounders doesn't link out to third-party sites — this is the complete detail available from the feed itself.