reverse-engineering 1 [email protected]: reverse engineering an npm supply chain dropper May 13, 2026