[salzig]

or, cause enabled is the default right now, it's way easier to spot malicious packages right now?

[jacques_chester]

I disagree. We don't know how many such packages run installation scripts without noticeably breaking.