NPM publish-time malware scanning and dual-use metadata | Dark Hacker News