Npm likes to run package lifecycle scripts of your dependencies by default. You have to explicitly opt out of this.

It’s probably the worst package manager out of npm, pnpm, yarn, and bun.