Malicious crossenv package on npm