If you look at the last N npm worms, they all used postinstall scripts.