Show HN: NPM install is a security hole, so we built a guard for it