Destructive malware available in NPM repo went unnoticed for 2 years Ars Technica 2025-05-22 19:15 Source Original site Payloads were set to spontaneously detonate on specific dates with no warning.