An auto-spamming payload published on npm spams the registry by spawning new packages every seven seconds, creating large ...