Shai-Hulud malware infects 500 NPM packages, leaks secrets on GitHub