NPM targeted by malware campaign mimicking familiar library names