A malicious NPM install reads your .env. On my Mac it reads a decoy

Write your take first — we'll ask for email only when you're ready to publish.