G github.com DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware 395 points tosh 1 year ago 283 comments