I initially had the same thought, but I came to a different conclusion because the presence of an install script is not a given for most packages. For example,

I initially had the same thought, but I came to a different conclusion because the presence of an install script is not a given for most packages. For example, if I installed a command line arguments parser and it claimed to require running a setup script, I would immediately be very suspicious. For a huge package like TypeScript, I'd probably just immediately let the script run and trust Microsoft to not publish malware (and NPM to not change the package contents).