Malicious npm packages abuse dependency confusion to profile developer environments