What the npm package attacks mean for us developers