A threat actor has published tens of thousands of malicious NPM packages that contain a self-replicating worm, security researchers warn.

Applications built by citizen developers using no-code platforms expand the attack surface without the same checks and balances as traditional development.