Comment by love2read

The fact that http fetches and fs reads don't prompt the user are continually the craziest part of the `npx` and `package.json`'s `postinstall`.

Does anyone have a solution to wrap binary execution (or npm execution) and require explicit user authorization for network or fs calls?