In the npm ecosystem, postinstall scripts are often overlooked attack vectors—they run automatically after a package is ...