Malicious NPM dependency injection in Unity Hub 3.1.0 targetting Russians

I can't see where on the page they mention it was targeting RU. Which npm package was it?