On August 1, npm Inc. — the company that runs the biggest JavaScript package repository — removed 38 JavaScript npm packages that were caught stealing environment variables from infected projects.

The roots of the problem were in a project Koçulu, a prolific developer of open source JavaScript libraries and a longtime unofficial evangelist for npm, had launched on npm called "kik"—a ...