Blocking install scripts closes one route for malicious npm packages. The malicious indexed-btree package shows why application code needs its own trust boundary.