New malicious npm package 'ambar-src' targets developers with open source malware