This is a nasty npm attack. It steals API keys and credits.