The tool gathered over 29,000 downloads before the malicious npm package was identified ...