Another Shai-Hulud variant hits npm packages, worming its way into hundreds of packages.