Malware found on npm infecting local package with reverse shell