thumbnail Malicious NPM Packages Exfiltrate Hundreds of Developer SSH Keys via GitHub