A malicious npm package pulled two million weekly downloads while running its payload from ordinary library code instead of an…