Hacker News Reader

Majority are benign, but when a package without one adds one, you probably want to see why :)

There's a reason I'll only ever run NPM in a VM on any machine that has any data I care about

Install scripts can be disabled with a config file, or npm flag, but your paranoia is not unwarranted.

Does deno (try to) solve any of this?

Deno does not have install scripts, or a lot of other npm+node features. You can turn these off in npm though if you want a hardened install step.