Dangerous Package Lifecycle Scripts

Detects npm/pip package lifecycle scripts that download and execute code, a common malicious package technique.

zakirkun 7ac294d 2 files · 2.3 KB Updated

File contents

Dangerous Package Lifecycle Scripts

Overview

npm package postinstall, preinstall, and install scripts run automatically when a package is installed. Malicious packages abuse this to:

  • Download and execute a remote payload
  • Exfiltrate environment variables (API keys, AWS credentials)
  • Install persistent backdoors

Remediation

  • Audit all postinstall scripts in node_modules
  • Use npm install --ignore-scripts for packages that don't need build steps
  • Use tools like npm audit, socket.dev, or snyk to scan packages

zakirkun/ice-tea/tree/main/skills/supply-chain/postinstall-scripts commit 7ac294d449

Frequently asked questions

npx skillmds@latest add zakirkun/dangerous-package-lifecycle-scripts