Does disabling install scripts actually do anything though? The attack would still work if put in the code itself, no? The only difference I can see is that it would run when the project is run instead of when the package is installed.

Sure but we’re talking about people who got laid of, they’re not getting a salary anyway. Unless starting a business gets rid of unemployment benefits I guess? But you can hold of on officially forming the business until you have some clients. I’m not saying it’d be easy, but I think it’s better than being unemployed

Tbf, unless there’s some massive capital expense that I’m not thinking about, you don’t really need any capital for doing software related work besides a computer, which most people already have anyway and maybe some office space. Software is about as capital lite as an industry can be, so if making a workers co-op under capitalism is going to work in any industry, it would be software.