From Dev.to
I Cloned a Repo and It Ran Code Before I Read a Single Line
03:03 in the morning, and a file appeared on my machine that I never asked for. I had typed exactly one command: npm install. The repo was my own sandbox, built five minutes earlier, and its package.j...