A new supply chain attack on npm, the node package manager, has injected the first malware with self-replicating worm ...