A Shai-Hulud copycat has turned up in yet another npm package just five days after TeamPCP open sourced the worm and ...