Post

Turning off install-scripts is net-good, and I'm glad that npm is tightening things up. Feels like there could be a middle-ground, perhaps in the future, to permit known-safe operations.

there could be a middle ground, but otoh I can't think of any valid use-cases for install scripts in a decent package manager

afaict they're used in the npm ecosystem to build or download native dependencies (both should be handled by the package manager and not by install scripts), and to set up boilerplate in your repo (e.g. adding git hooks or prisma generate, which should be done as a separate setup command)