BA vulnerable npm package which steals passwd