Npm team warns of new 'binary planting' bug

Npm bug lets booby-trapped npm (JavaScript) packages plant or alter binaries on the victim's system.