A mysterious npm worm published 46K fake packages in a two-year spam campaign, exposing major security gaps.