Well, because it is really easy to diff an npm package.

The attacker had access to the user's npm repository only.