On: Curl to shell isn't so bad

[paulddraper]

npm removes malware when reported.

[acdha → paulddraper]

Which is repeating that sources matter: curl from a source like Github with a solid abuse process is a very different story than an unknown server.

[mceachen → paulddraper]

s/when/if/

Fixed that for you.

[paulddraper → mceachen]

I don't believe that changes the meaning.

[mceachen → paulddraper]

(sorry, it was an obscure inverted reference to the saying "not if, but when")