Cybersecurity researchers at Socket have uncovered a malicious npm package that hijacks server control during payment transactions.