Supply-chain controls matter more when agents install your dependencies | Hacker News Reader