Posthog NPM packages are compromised