pkgproof: check an npm package before it gets installed | x402scan