policy supply_chain ai_generated partial

npm install runs arbitrary postinstall scripts from untrusted packages, potential supply chain attack

ID: policy/npm-install-postinstall-script-risk

Also available as: JSON · Markdown
70%Fix Rate
82%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

npm runs lifecycle scripts (preinstall, install, postinstall) automatically on install. Malicious packages use postinstall to execute arbitrary code. This runs with the same permissions as the user running npm install.

generic

Workarounds

  1. 90% success Use --ignore-scripts flag to prevent lifecycle script execution 
    npm install --ignore-scripts  # then manually run build scripts for trusted packages
  2. 85% success Use npm audit and enable npm provenance for supply chain verification 
    npm audit --production; npm config set //registry.npmjs.org/:_authToken $TOKEN
  3. 88% success Use a lockfile (package-lock.json) and review diffs on dependency updates 
    Always commit package-lock.json. Review lockfile diffs in PRs to catch unexpected dependency changes.

Dead Ends

Common approaches that don't work:

  1. Assume npm packages from popular authors are safe to install 85% fail

    Supply chain attacks target popular packages via typosquatting, account takeover, or dependency confusion. Popular ≠ safe.

  2. Review package code on npmjs.com before installing 78% fail

    npmjs.com shows the published code, but postinstall scripts can download and execute additional code at install time. Static review misses this.