OpenCode was stopped before running a malicious postinstall script

A redacted example of a supply-chain attack via npm install.