Essentially every package manager has to allow that, and every package manager I can think of does allow that. What's your threat model anyway? The package itse

Essentially every package manager has to allow that, and every package manager I can think of does allow that. What's your threat model anyway? The package itself will run arbitrary code once you start using it. Is it so problematic if it starts doing that at installation instead of later?