Comment on Popular NPM library hijacked to install password-stealers, miners