Show HN: A malicious NPM install reads your .env. On my Mac it reads a decoy | Hacker News Reader