NPM publish-time malware scanning and dual-use metadata | Hacker News Reader