Is that not true of most dependency manager + build systems? To focus on maven as an example, maybe it doesn't have a post-install hook for dependencies it down

Is that not true of most dependency manager + build systems? To focus on maven as an example, maybe it doesn't have a post-install hook for dependencies it downloads, but any build or test dependencies downloaded while building a project are going to be immediately executed unsandboxed. At least npm has the package-lock.json feature that lets you lock down the entire dependency graph. If the package-lock.json was created with a safe set of dependencies, then any dependencies compromised in the future won't affect you (because already released versions can't be modified). Maven and gradle both seem to entirely lack a comparable feature as far as I know; if they do have that functionality as an obscure feature or plugin, then I still criticize them for not making it more prominent. (Npm generates and uses package-lock.json by default!)