Closing the Binary Blind Spot: Domain-Knowledge Injection for LLM Malware Triage in npm Packages Databricks