How many more examples of malware postinstall scripts do we need before Node quits running them by default, without warning?