How npm install scripts can be weaponized: a real-world example | Hacker News Reader