A npm worm prepared 42 GitHub repositories and hid their malicious loads in files too large to appear in some regular searches. JFrog links the campaign with hijacked accounts, theft of credentials and mechanisms to spread between development packages and tools.