Catching the Silent Threat: How Dynamic Analysis Revealed an NPM Attack Chain