How npm install scripts can be weaponized: A real-world example of a harmful npm package