Sad state of package management security | Hacker News Reader