Все обеспокоены кодом, который выполняется во время установки. Я проверил 25 популярных пакетов: 0 установочных хуков.

Оригинал

Everyone's Worried About Code That Runs at Install Time. I Checked 25 Top Packages: 0 Install Hooks.

This week's developer news had a story with a shape I can't stop thinking about: Postman reportedly shipped an update that auto-installed plugins into people's AI coding tools — Claude Code, Codex, Cursor, Copilot — without asking first. They said they'd revert it. But the episode points at a door most of us leave wide open without a thought: Code runs when you install things. Not when you run the program. When you install it. In npm, that door is the install script: preinstall, install, posti