DirtyBlanket: Fake Express Packages on npm Spread a Linux Worm
safedep.io
Nine fake Express and React packages on npm run a Linux worm at install time. It installs a Tor backdoor and spreads through SSH, AUR packages, and npm tokens.