There are npm packages, like esbuild, that need postinstall support to install binaries or run other scripts. While we could allow any package to run scripts, that wouldn't be the safest thing to do. We also can't not support it at all, because these packages would simply not work.

We're thinking of adding a new trustedDependencies property to the package.json, which would require developers to explicitly define an allowlist of packages that are allowed to run scripts.

{
  "private": true,
  "dependencies": {
    "esbuild": "^0.17.8"
  },
  "trustedDependencies": [
    "esbuild"
  ]
}

This would not extend to child dependencies, so if package foo depends on bar, and foo is on the allowlist, bar is not on the allowlist, unless it is explicitly added.