[philipwhiuk]

The entire use-case of that package is a security nightmare.

[gear54rus]

Then don't use it. Just don't presume to tell me if I can or can't.

[dgellow]

Given that has an impact over the whole industry, I will for sure tell you that patching on install SHOULD NOT be a thing. Up to you to run your own post install script yourself

[port11]

You’re free to allow scripts as per the linked docs for NPM 12. But the vast majority of us will appreciate the reduced attack surface.

[jeremyjh]

TFA explains how this works, and how to opt out.