https://www.veracode.com/blog/malicious-npm-package-targeting-github-actions/