Eight NPM packages with 40,000 downloads have been delivering malware in the MALFEX supply chain attack campaign.