Ethereum smart contracts used to push malicious code on npm