Worm-like propagation
Named by 2 kept items in this workspace.
Search every workspace for Worm-like propagation. It matches the name as written, so it can find other things that share it.
The items that name it 2
Auto-republish with stolen tokens
Using harvested npm authentication tokens/access to publish additional malicious packages, propagating the compromise further
All techniques in this workspace.