FYI: There has been an open RFC since 2021 to make install scripts opt-in for NPM: github.com/npm/rfcs/pull/488 About high time it is accepted and ratified! The pain of making this change will be ower than whatever horror will come next in the NPM ecosystem.

Make npm install scripts opt-in by tolmasky · Pull Request #488 · npm/rfcs

Install scripts that can run just about anything by default pose some pretty serious security considerations, and these are inreasingly moving out of the theoretical realm and becoming actively exp...

github.com

Sep 18, 2025 · 2:10 AM UTC

1
2
1
11
Also - at one point NPM used to hold RFC office hours but this was suspended over two years ago.