Sensitive browser and Discord files stolen by npm package