Shai-Hulud variant poisons 444 packages, spreads via tarballs and dev-tool hooks