BlogInside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE HooksAugust 4, 2026