No, the ”vulnerability” here is npm unilaterally allowing postinstall scripts, which are then used as an entry point for malware.
Of course, the malware could just embed itself as an IIFE and get launched when the package is loaded, so disallowing postinstall is not really a security solution.
Of course, the malware could just embed itself as an IIFE and get launched when the package is loaded, so disallowing postinstall is not really a security solution.