[tlrobinson]

"Scanning tools for dangerous packages"

This seems like an impossible problem (essentially the halting problem). On Linux perhaps you could build packages in a container then copy the results to the installation directory, but there's no guarantee require("rimrafall") won't just "child_process.exec('rm -rf /')".

[politician]

At the very least, they could install packages in a VM and check that the VM can be rebooted.

[tlrobinson]

Then someone could just craft a package that deletes every file except the ones required for booting...