Post details
Just opened an npm RFC to make dependency install scripts opt-in by default. The thing about install scripts: they run the moment a package lands in your dep tree. No require, no review. That's why Shai-Hulud, chalk/debug, and Axios all used them. https://github.com/npm/rfcs/pull/868










