As npm invalidates compromised developer accounts linked to the 'Mini Shai-Hulud' worm, security researchers expose lingering local backdoors targeting crypto seed phrases.