NPM package adds postinstall self-ad | Hacker News Reader