Even if the pre/post install hooks are removed, you can still execute code in the source code files using some exec command. Doesn't catch as many people out, b

Even if the pre/post install hooks are removed, you can still execute code in the source code files using some exec command. Doesn't catch as many people out, but anyone running an app locally has given it permissions to your shell. This is the same problem for Go and other package managers right? I guess the best defence is some npm install alternative that runs a check against a trusted registry of modules that have been audited. Does that exist already?