Hacker News Reader

Both NPM and Yarn have a way to disable install scripts which everyone should do if at all possible.

Good point, but until many popular packages stop requiring install.sh to operate, you'll still need to allowlist some of them. That is built into the PNPM tooling, luckily :)

Reply on news.ycombinator.com