Comment by JadoJodo

5 days ago

Would the adoption of a Deno-like security posture in NPM have mitigated this?

pnpm is the better comparison maybe in this context. Most of Deno's approach to security is focussed on whole program policies which doesn't do much in this context. Just like pnpm and others, they do have opt-in for install scripts though. The npm CLI is an outlier there by now.