Illicit AI-assisted commit-linked npm dependency compromises crypto wallets