For what it's worth, both bun and deno disable lifecycle scripts by default (bun has a default allowlist of the top 500 npm packages with lifecycle scripts, how

For what it's worth, both bun and deno disable lifecycle scripts by default (bun has a default allowlist of the top 500 npm packages with lifecycle scripts, however none of the affected packages are on that list: https://github.com/oven-sh/bun/blob/main/src/install/default-trusted-dependencies.txt https://github.com/oven-sh/bun/blob/main/src/install/default...). Switching to a secure-by-default package manager, I think, is something this type of event should make us all reconsider.