Malicious NPM packages are part of a malware “barrage” hitting repositories
arstechnica.com