Backdoored Module Removed from npm Registry
A malicious package masquerading as a cookie parsing library but delivering a backdoor instead was unpublished from the npm Registry along with three other packages.
Read more: Backdoored Module Removed from npm Registry
Story added 4. May 2018, content source with full text you can find at link above.