NodeJS module downloaded 7M times lets hackers inject code