How npm install scripts can be weaponized: A real-world example | Heykuki News