Malware hidden inside NPM with invisible Unicode and Google Calendar invites [video]