Self-replicating Shai-hulud worm spreads token stealing malware on npm