https://blog.sonatype.com/fake-distube-config-npm-package-drops-windows-info-stealing-malware