Having post-install step available to maliciously use doesn't really solve anything. As you're a programmer downloading a dependency, you're allowing the depend

Having post-install step available to maliciously use doesn't really solve anything. As you're a programmer downloading a dependency, you're allowing the dependency full control of your system (in most language, Deno seems to try to address this at least) at runtime (at least), so they could do whatever they want as soon as you include the dependency in your application and run it once.