NPM flooded with malicious packages downloaded more than 86k times