Postinstall hooks are a footgun. The bad part here is that people reviewing a PHP package may not even look closely at package.json.