Threat actors are publishing malicious NPM packages to steal PayPal credentials and hijack cryptocurrency transfers.