security: remove `postinstall` script in favor of `prepublish` script

[coolaj86]

(socket) svelte-preprocess@5.0.4 contains risks:
Install scripts - Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.
Accept risks of installing these packages (y/N)?

See also: @SocketDev

Feature requests and proposals

The postinstall script will always run, even for deeply nested dependencies.

The prepublish script will run when someone is running npm install from the repo, and before npm publish.

Currently the install script is used to write a message to the screen which is not actually necessary for people who have this as a dependency.

[dominikg]

the message is intended for users, but I agree that it would be better if it was made at runtime if a missing dependency was detected. vite handles this for sass for example, reminding you to install it if you didn't

[dominikg]

it is however not a security issue in this case as it only runs "echo". You can safely disable this postinstall script with your package manager if it still concerns you

[linonetwo]

postinstall cause install failed

(base) PS C:\Users\linonetwo\Documents\repo-c> pnpm dlx tiddlywiki-plugin-dev@latest init principles
 WARN  3 deprecated subdependencies found: @types/sass@1.45.0, glob@7.2.3, inflight@1.0.6
Packages: +262
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Progress: resolved 296, reused 262, downloaded 0, added 262, done
AppData/Local/pnpm-cache/dlx/lnl3bso5nsziqdo3mm5irqwjda/192c80c5316-55c/node_modules/.pnpm/svelte-preprocess@6.0.3_less@4.2.0_postcss-load-config@4.0.2_postcss@8.4.4AppData/Local/pnpm-cache/dlx/lnl3bso5nsziqdo3mm5irqwjda/192c80c5316-55c/node_modules/.pnpm/svelte-preprocess@6.0.3_less@4.2.0_postcss-load-config@4.0.2_postcss@8.4.47__postcss@8.4.47_s_5rjt4kelkk6vyjtbgrhdvx47um/node_modules/svelte-preprocess: Running postinstall script, failed in 4ms
.../node_modules/svelte-preprocess postinstall$ echo "[svelte-preprocess] Don't forget to install the preprocessors packages that will be used: sass, stylus, less…
└─ Failed in 4ms at C:\Users\linonetwo\AppData\Local\pnpm-cache\dlx\lnl3bso5nsziqdo3mm5irqwjda\192c80c5316-55c\node_modules\.pnpm\svelte-preprocess@6.0.3_less@4.2.0_postcss-load-config@4.0.2_postcss@8.4.47__postcss@8.4.47_s_5rjt4kelkk6vyjtbgrhdvx47um\node_modules\svelte-preprocess
 ELIFECYCLE  Command failed with exit code -4058.

---

solved after move into optionalDependencies

[ishamf]

pnpm v10 disables the script by default and shows a warning, and yarn is considering to do it as well (article). Maybe it's time to revisit this?