Thousands of Malicious npm Packages Threaten Web Apps