One Token to leak them all: The story of a $8000 NPM_TOKEN | Hacker News Reader