This gives yet another example of why "ignore scripts"[0] should be the default setting for npm install. Actually it's a pity that the npm Security Insights AP

This gives yet another example of why "ignore scripts"[0] should be the default setting for npm install. Actually it's a pity that the npm Security Insights API[1] seems to have been abandoned since the company was bought by Microsoft. It seems like it could have highlighted the addition of a suspicious install script, although how useful it would be in practice would depend on the UX of the tooling that uses it. [0] https://www.nerdycode.com/prevent-npm-executing-scripts-security/ https://www.nerdycode.com/prevent-npm-executing-scripts-secu... [1] https://blog.npmjs.org/post/189189888357/npm-security-insights-api-preview-part-3 https://blog.npmjs.org/post/189189888357/npm-security-insigh...