[jacques_chester]

I think NPM should consider flipping the default on this. Code that requires an install script should be the odd case that draws scrutiny.

[salzig]

or, cause enabled is the default right now, it's way easier to spot malicious packages right now?

[jacques_chester]

I disagree. We don't know how many such packages run installation scripts without noticeably breaking.