JavaScript package users have been warned to update due to a bug that could enable an attacker to infect them with malicious applications.