RFC: Make NPM install scripts opt-in
It boggles my mind that languages and package managers do not support ACLs for libraries.<p>leftpad has no need of install scripts, nor `eval`, reflection, or access to my disk or the network.  <i>nor should it be allowed to gain them in the future</i>, at least without a million alarm bells ringing and explicit approval.<p>ACLs would allow establishing &quot;moats&quot; of dramatically-more-difficult-to-attack libraries, and encourage libraries to <i>voluntarily</i> reduce their attackable surface to make them more likely to be approved.  Instead we have <i>this</i>.