According to Koi Security, a legitimate-looking developer managed to slip in rogue code within an npm package called " ...