Malicious npm package indexed-btree impersonated sorted-btree, using nearly 2M weekly downloads to steal data and deliver payloads.