The usage of an install script is a vulnerability issue. It downloads an unsigned binary to the executing machine, which opens the way for potentially malicious code to be unintendedly downloaded. The NPM package should contain the binary such that it's there when installed and the install script can be omitted. This will make sure that an install of a locked version of the package will always result in the same artifact, which also helps with caching.