Nefarious npm package exposes backdoors on the programmer’s devices