supply chain security

CLI Tools Shouldn't Install Background Daemons by Default

A developer runs npm install -g @openai/codex to try an AI coding assistant, and ends up with a persistent, self-updating background daemon they never asked...