Malware found on NPM infecting local package with reverse shell