NPM flooding case-study: “Down the Rabbit Hole looking for a Tea”

TL;DR:

While the presence of malicious code in package registries is well-known, there are other strange or unusual behaviors that completely go unnoticed by the regular users of these registries. Even for those of us who keep a close watch on them, it is not easy to find a reason or explanation for such behavior. Read about it!