GitHub pulls pin on NPM's auto-run scripts | Dark Hacker News