Publishing trojanized npm packages