Dangerous Package Lifecycle Scripts
Overview
npm package postinstall, preinstall, and install scripts run automatically when a package is installed. Malicious packages abuse this to:
- Download and execute a remote payload
- Exfiltrate environment variables (API keys, AWS credentials)
- Install persistent backdoors
Remediation
- Audit all
postinstallscripts innode_modules - Use
npm install --ignore-scriptsfor packages that don't need build steps - Use tools like
npm audit,socket.dev, orsnykto scan packages