A wake-up call for security on third-party packages | Hacker News Reader