Keyv and friends compromised in npm supply chain attack