Shai-Hulud Returns: Over 300 NPM packages infected via fake Bun runtime within hours