pre- and post- install scripts should just be abolished. It should require a special dispensation from npm to even publish one.

Yes, I choose to use pnpm but opt-in safety isn't going to get the developer community to herd immunity.