node ./dist/scripts/postinstall.js
The script appears to be a post-installation cleanup tool. It loads the package.json file related to the script's project, removes several fields from it (dev scripts, eslintConfig, devDependencies and dependencies), and then writes the modified package.json back to disk. Afterward, it removes specific directories within the dist
folder. There's no code designed to steal sensitive information, get root access to local resources, run or download remote code, or harm the system explicitly. Instead, it appears to tidy up after an installation to remove unnecessary parts of a package for a production environment, possibly to reduce the footprint of an application.
@gusmano/reext
's direct dependencies. Data on all dependencies, including transitive ones, is available via CSV download.