Socket's threat researchers have uncovered a package lurking in npm for six years that awaits a remote command to wipe ...