bb26 Dummy upstream npm package source for bug bounty 2026 upstream-poisoning CTF target (staging only, teardown August 2026)