Crossenv malware on the npm registry
blog.npmjs.org