Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

It's crazy to me that npm still executes postinstall scripts by default for all dependencies. Other package managers (Pnpm, Bun) do not run them for dependencies unless they are added to a specific allow-list. Composer never runs lifecycle scripts for dependencies.

This matters because dependencies are often installed in a build or development environment with access to things that are not available when the package is actually imported in a browser or other production environment.

It does not, since version 11:

https://docs.npmjs.com/cli/v11/using-npm/changelog#1100-pre0...

Yes it does, since the ignore-scripts option is not enabled by default.