Tag

npm-postinstall-script-malware

Safeguard articles tagged "npm-postinstall-script-malware" — guides, analysis, and best practices for software supply chain and application security.

1 article

Open Source Security

Post-Install Scripts: The Overlooked Execution Point Atta...

Postinstall scripts run automatically on `npm install` with full user privileges—no review required. Here's how attackers exploit them, from ua-parser-js to Shai-Hulud.

Aug 1, 20258 min read