Crypto-coin-stealing code sneaks into fairly popular NPM lib
theregister.co.uk