Phantom dependencies in JavaScript package managers | Dark Hacker News