this npm attack persists after you uninstall it #malware #devwarning