security: require opt-in for automatic npm restore to avoid build-time script execution

security: require opt-in for automatic npm restore to avoid build-time script execution #61