NPM package targets web3 smart contracts with new malware