NPM package 'is' with 2.8M weekly downloads infected devs with malware | Hacker News Reader