[RFC] Make install scripts opt-in by JamieMagee · Pull Request #868 · npm/rfcs

Summary Block dependency install scripts (preinstall, install, postinstall, and auto-detected node-gyp builds) by default during npm install. Projects opt in to running scripts for specific dependencies via a new allowScripts field in package.json. Two new CLI commands, npm approve-scripts and npm deny-scripts, help users build and maintain the allowlist. npm is the only remaining major package ma

[yosuke_furukawa]

install script をoptinにするべきではないかという提案。2段階で提案されていて、phase1で警告するようになり、phase2で未承認のものはブロックするようにという提案。