It’s not a security hole. When you build whatever software on whatever language you execute build scripts. It’s a feature of every package manager that I know b

It’s not a security hole. When you build whatever software on whatever language you execute build scripts. It’s a feature of every package manager that I know because, even for interpreted languages there is always the case of needing to compile some native code extensions and thus you need the possibility to run scripts. Just don’t run npm install (or pip install) on a production server but install things exclusively from the distro packages or if they are not available use a container. On your PC… keep a backup on hand and possibly don’t save the keys that you use to access production systems on a txt file.