npm lifecycle scripts are the biggest supply-chain hole in this whole flow — we…

Max Kle1nz@maxkle1nz

npm lifecycle scripts are the biggest supply-chain hole in this whole flow — we're building an upstream repo we don't control. --ignore-scripts means installing dependencies cannot execute arbitrary code at install time; only the explicit `npm run build` step runs anything from the upstream. If the build ever starts requiring a postinstall script, that becomes a visible, reviewed change here instead of an invisible default.

  if [[ -f "$OMX_SOURCE_DIR/package-lock.json" ]]; then
    log "Installing upstream OMX dependencies with npm ci --ignore-scripts"
    (
      cd "$OMX_SOURCE_DIR"
      "$NPM_BIN" ci --ignore-scripts
    )