Widely used open source software contained bitcoin-stealing backdoor Malicious code that crept into event-stream JavaScript library went undetected for weeks.