The malware authors behind the npm worm Shai-Hulud have released the source code. Now the first clones are appearing.