https://socket.dev/blog/spearphishing-campaign-abuses-npm-registry?utm_medium=feed