Maintainer scripts lower the bar for the attack. In order to get the code in scripts executed at a predictable time – you add it there and done. In order to ge

Maintainer scripts lower the bar for the attack. In order to get the code in scripts executed at a predictable time – you add it there and done. In order to get the code in the library executed on the build box, you have to add it somewhere that's actually used by the environment you want to attack. Scripts allow more coverage more easily. Plus, it's not unheard for people to run "npm" as root to run some scripts as root.