NPM package targeting Prettier ecosystem drops malware