Shai-Hulud: What an NPM supply-chain hack reveals about the limits of provenance | Dark Hacker News