Another attack on npm, not surprising

The Rust ecosystem is on borrowed time until this is done to Crates.io