anything except that it's malware installed via npm