I always advocate switching to pnpm where install scripts are disabled by default. It has plenty of security features to ward off most supply chain attacks.

• https://pnpm.io/settings#onlybuiltdependencies
• https://pnpm.io/settings#minimumreleaseage
• https://pnpm.io/blog/2025/12/29/pnpm-in-2025#security-by-default

Pre and post install hooks are a mistake, jfk

It gets better and better lol