I would expect to be able to download a package and then inspect the code before...

		theodorejb 25 days ago \| parent \| context \| favorite \| on: NPM flooded with malicious packages downloaded mor... I would expect to be able to download a package and then inspect the code before I decide to import/run any of the package files. But npm by default will run arbitrary code in the package before developers have a chance to inspect it, which can be very surprising and dangerous.

npm used to do that. bun never did. No idea about the past for pnpm or yarn.