Invisible npm malware pulls a disappearing act then nicks your tokens