An active worm in the npm JavaScript repository is spreading across more than 2,000 versions of 444 unique packages after a ...