NPM install scripts can be weaponized | Heykuki News