Lottie Player NPM package compromised in supply chain attack