NPM package ‘debug’ v4.4.2 contains malware