AI-Generated npm Malware Accidentally Exposes Threat Actor’s Private GitHub Token