LinkedIn calls it a smear campaign, but does not deny scanning people's browsers for extensions.
North Korean hackers used an updated version of a known backdoor to target a popular npm package.