Microsoft warns two npm packages deploy a RAT that steals crypto wallet credentials, screenshots and keystrokes via Hugging Face.