NPM install scripts can be weaponized | Hacker News Reader