Unpacking the AsyncAPI NPM supply chain compromise, import-time payload delivery (microsoft.com)