https://blog.sonatype.com/npm-packages-caught-spreading-bladeroid-info-stealer