A npm supply-chain campaign has been linked to an emerging cryptojacking operation targeting rented GPUs, researchers say.