In this case even if you skimmed it you likely would have missed it since the malicious change was adding a new dependency called "atomic-lockfile".