Npm packages have been caught while installing trojans