> any installation system that can run arbitrary scripts/commands as a part of the install has this same problem. This anti-feature should be removed, and other

> any installation system that can run arbitrary scripts/commands as a part of the install has this same problem. This anti-feature should be removed, and other safer workarounds provided. 1000% agreed. I might need to refactor the article to remove the focus on NPM. It was cited for two reasons: - awareness that an important RFC that people need to vote on - npm is related to ua-user agent-parser incident (mystery meat in a binary package)