A self-spreading package published on npm spams the registry by spawning new packages every every seven seconds, creating ...