How not to publish malicious npm packages | Dark Hacker News