IIRC, yarn disables script invocation when installing a package, and there is a separate mechanism to run them if you need to. I don't remember the full details

IIRC, yarn disables script invocation when installing a package, and there is a separate mechanism to run them if you need to. I don't remember the full details of how it works, though. Given NPM's increasing viability for large scale supply-chain attacks, there are other things to worry about still. Perhaps those other things are more fundamental to NPM's design and can't be changed overnight. It's still helpful to solve these simpler problems.