Security warning should mention which package executes package scripts
Author: corneliusroemerCreated Aug 19, 2026Updated Aug 19, 2026
It seems that this security warning was recently introduced: warning libmamba Security Warning: This transaction includes executing package scripts (pre/post-link/unlink) if present. These scripts can contain arbitrary code. Please ensure you trust the package sources.
It would be nice if the warning included more details: right now it just says "if present". Would it be possible to introspect packages and see which ones run pre/post-link/unlink and inform the user? Otherwise this is pretty blanket and hard to action.
Source: mamba-org/mamba