This is terrible on so many levels. Why does npm execute scripts by default if they are not to be trusted? Why would anyone install some software via npm unle

This is terrible on so many levels. Why does npm execute scripts by default if they are not to be trusted? Why would anyone install some software via npm unless they are confident it isn't malicious? Why does npm use a single flag for scripts in all contexts and if this thing is a known problem, why don't they add a flag for handling this specifically?