A New Tool Wants to Save Open Source from Supply Chain Attacks | Hacker News Reader