lighthouse-runner

The package's install-time actions are primarily to build sources and to run Playwright's installer for Chromium. This is not overtly malicious, but it carries moderate supply-chain and execution risk: npx invocation during postinstall allows remote code execution if the registry or npx behavior is subverted, and Playwright's installation downloads and runs additional software (browser binaries). If you trust the upstream packages (playwright, tsdown) and your npm registry, this is expected behavior for a Playwright-based tool. If you require a stricter security posture, avoid automatic postinstall network installs, audit tsdown and playwright package contents, or run installs in an isolated environment.