Delivering malware via Google Calendar invites and PUAs in an NPM package