Okay then, explain to me why this is only possible with NPM? Does it have a hidden "pwn" button that I don't know about?
>Does it have a hidden "pwn" button that I don't know about?
Perhaps its package owners do.
NPM executes packages as you download them.
https://docs.npmjs.com/cli/v8/using-npm/scripts