Coming from nvm, I've repeatedly found myself doing volta install 10 intending to install node@10. Instead, that installs some random package. I expect it runs that project's install script, too, meaning that it's also running arbitrary code on my computer.

That seems bad.

I think it would be worth having the CLI stop you from doing this, or at least make you confirm that it's what you really wanted. That is, concretely, the CLI should have a warning when the package name starts with a decimal digit and there is no specified @ version number.

(Even better would be if the CLI had different syntax for installing node vs installing random packages. It seems bad to overload install so much.)