Unpacking the AsyncAPI NPM supply chain compromise, import-time payload delivery