Microsoft spots malicious npm package stealing data from UNIX systems