Someone has been flooding npm with wormlike packages in a bid to get as many crypto tokens as they can.