Why is an obfuscated JavaScript payload part of an NPM command? | Heykuki News