> At that point, “npm install” feels less like importing a library and more like executing a supply chain

Which is why pre and post install scripts should never had been added.