⚠️ WARNING: a fake "developer assessment" project — malware hidden in npm scripts