A mystery payload sneaked into a hugely popular JavaScript library was part of a plot to ransack Bitcoins from BitPay’s Copay mobile cryptocoin wallet, it has been alleged.