Npm package with millions of downloads is at risk from malware hijacking

Hackers were deploying malware through a popular npm package for six hours.