GitHub disables npm auto-run. Hooray.

GitHub has finally disabled npm's auto-run scripts after the Shai-Hulud worm exploited them. This brilliant feature naturally affected unsuspecting developers who trusted the default settings. We are told to protect ourselves by accepting this late fix, which delights everyone except the malware authors. It is a classic case of shutting the stable door after the horse has bolted, but at least we can pretend we are secure now.