I think these compromises show that install hooks should be severely restricted. Something like, only packages with attestations/signed releases and OIDC-only

I think these compromises show that install hooks should be severely restricted. Something like, only packages with attestations/signed releases and OIDC-only workflow should allow these scripts. Worm could propogate through the code itself but I think it would be quite a bit less effective.