Hackers Use Ethereum Smart Contracts to Mask Malware in NPM Packages