If you look at the last N npm worms, they all used postinstall scripts.

Is that even true?

shai-hulud and variants

So N=1? 2? 3?

	▲	tkel 25 days ago \| parent [-]
		at least 3 that i can remember off the top my head in these last couple months. If you look further back you will find more.