Not running arbitrary code is a feature, that yarn brings back to the js ecosystem.

It sounds nice in theory, but it impacts the soundness of the whole system.