[_betty_]

how about requiring some kind of interaction if they want to run an install script?

[jsheard]

Pnpm already did that: https://github.com/pnpm/pnpm/releases/tag/v10.0.0