What are the two distinct entry points for supply-chain risk in a frontend project?

Short interview answer

Install-time: a package or its postinstall script executes on the build machine or a developer's machine with that environment's privileges. Run-time: a third-party script executes in the user's browser inside your origin, with access to the DOM, cookies, and storage. They need different controls.