NPM debug and chalk packages compromised