@volpeon maybe npm should not be able to run arbitrary scripts