A threat actor has published tens of thousands of malicious NPM packages that contain a self-replicating worm, security researchers warn.