How npm preinstall and postinstall scripts can serve as methods to inject malicious code into open source packages.