The what happened section mentions the addition of the `setup.mjs` and `Math_Symbol.js`, along with a change in `package.json` to add `"preinstall": "node setup.mjs"`, so presumably checking for any of those would be a good indication to check further.

For example:

    find . -type f | grep -P "/Math_Symbol\.js$"

Highly recommend `fd` for the sheer speed:

    fd -HI "^(setup\.mjs|Math_Symbol\.js|math_init\.js)$"

2. `brew install fd`

This article has a lot of information and ways to check & clean: https://safedep.io/keyv-npm-supply-chain-compromise/

find . -type d -name node_modules -prune -exec find {} \( -name setup.mjs -o -name math_init.js -o -name Math_Symbol.js \) \; 2>/dev/null