I thought this was a case of Source code virus[1]. With the current popularity of open source and services like github, combined with deep inter-dependencies in node.js, a virus of this kind could have a huge impact if unnoticed for long enough.

Maybe it is the next plague waiting to happen?

[1] https://en.wikipedia.org/wiki/Source_code_virus