npm package contained hidden malware by using Private Use Access unicode characters https://www.aikido.dev/blog/youre-invited-delivering-malware-via-google-calendar-invites-and-puas