The no-op preinstall script is a security risk and will cause friction for developers using npm v12, pnpm, and other npm clients that error on packages that define install script hooks.
https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/
https://pnpm.io/supply-chain-security#block-risky-postinstall-scripts
I'm calling it a security risk, not because there's a vulnerability in @google/genai's preinstall script today, but because developers may thoughtlessly and needlessly approve @google/genai which opens the door if an attacker manages to compromise this repository and publish a malicious script.
The preinstall script adds friction too, when I updated by dependencies I was prompted to review and approve @google/genai's scripts. Which I denied, since it's just a no-op, but it took time out of my day. If I maintained a library I'd hesitate to production-depend on this package, or any package with a install script because I don't want my consumers to have to make the same choices.
The no-op preinstall script is a security risk and will cause friction for developers using npm v12, pnpm, and other npm clients that error on packages that define install script hooks.
https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/
https://pnpm.io/supply-chain-security#block-risky-postinstall-scripts
I'm calling it a security risk, not because there's a vulnerability in @google/genai's preinstall script today, but because developers may thoughtlessly and needlessly approve @google/genai which opens the door if an attacker manages to compromise this repository and publish a malicious script.
The preinstall script adds friction too, when I updated by dependencies I was prompted to review and approve @google/genai's scripts. Which I denied, since it's just a no-op, but it took time out of my day. If I maintained a library I'd hesitate to production-depend on this package, or any package with a install script because I don't want my consumers to have to make the same choices.