Official SAP npm packages compromised to steal credentials