BlogInside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks4. August 2026