NPM packages from Red Hat have been compromised