Post #2739577

@zachleat@fediverse.zachleat.com npm needs to make prepare/postinstall hooks opt-in and allow-listed instead of on by default for the whole universe and a declarative/sandboxed solution for packages that have to download and compile as an escape hatch (something like flathub's manifest where the framework does the downloading for you and rejects anything that doesn't match the expected hashes) absurd that even crates.io has the same problem and no solution in sight :S