Someone compromised SAP's npm packages and used the CI pipeline against itself