> ...NPM since those can differ from source code on Github. True. How about people act their threat model? Instead of removing a feature for many users, just d

> ...NPM since those can differ from source code on Github. True. How about people act their threat model? Instead of removing a feature for many users, just do whatever you need to do to be sure you're safe yourself? In what other major situation is the solution to nuke a feature due to security concerns? Afaik the main conversation about postinstall is around leeches complaining about political messages in their console and one or two other incidents