Malicious NPM and PyPI packages steal user information