Nuget has the same issue - it can execute arbitrary code during installation. Perhaps it's being exploited already but nobody noticed?

Regardless, even in case of package managers that don't have install scripts (e.g. Maven) one could simply insert malware directly into library code and have it execute whenever you run tests or your application.

The only true solution would be some sort of sophisticated sandboxing or sophisticated malware detection or distributed code review.