Sloppy AI-generated npm infostealer leaked its own GitHub token, exposing the operator