@joesteel I don’t like install-time scripts, either, so I disable them. However, as soon as a dependency is referenced as part of app development or testing, any malicious code it has could run, so I’m not sure this is a meaningful security difference. Your point about the large number of dependencies feels much more relevant to me. However, I’m not sure that’s a design problem with npm as much as a culture in the JavaScript ecosystem.