GitHub pulls pin on NPM's auto-run scripts
theregister.com