BlogInside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks4 de agosto de 2026