A poisoned npm release of Tensorlake's SDK carried a payload that hunts cloud credentials and can wipe a home directory.