Copycat hits another npm package