Trojanized npm packages spread new variant that executes in pre-install phase, hitting thousands within days A ...