Destructive malware available in NPM repo went unnoticed for 2 years