When restricting which dependencies may run lifecycle (install/postinstall) scripts, explicitly maintain and audit the `trustedDependencies` list, and verify that your CI pipeline actually enforces the intended security behavior rather than silently succeeding. Package managers like Bun will skip untrusted lifecycle scripts by default and still report a successful install, so a CI step that only checks the install command's exit code gives a false sense of safety — a new dependency requiring a script for correct operation can pass CI and break (or silently miss security-relevant setup) at runtime. Make sure: (1) any claim in documentation or PR descriptions about "install failing on untrusted scripts" matches actual tool behavior — correct or remove such claims if the tool only warns/skips; (2) CI explicitly checks for skipped/untrusted lifecycle scripts (e.g., via `bun pm untrusted` or equivalent) and fails the build if unexpected packages require scripts, rather than relying solely on the install exit code; and (3) every dependency added to `trustedDependencies` is deliberately reviewed, since lifecycle scripts are a known supply-chain attack vector and blanket or accidental trust can expose the build/runtime environment to malicious code execution.