NPM install is arbitrary code execution. We give it a disposable VM | Dark Hacker News