Every npm security checklist says the same thing: audit "preinstall" and "postinstall" scripts. The attacker behind this campaign read the same checklist — and built around it. In a 10-hour window...