When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works. Over 43,000 dormant spam packages flooded npm in a coordinated two-year campaign Some packages ...