Redirecting to The Worm in the Machine: Dissecting the Self-Spreading npm Attack