thousands of npm packages hacked and exploited