NPM package posthog-js 1.297.3 contains malware | Not Hacker News!