Thousands Download Malicious npm Libraries Impersonating Legitimate Tools