Multiple npm packages have been compromised by a phishing attack in an attempt to spread crypto malware to billions of victims.