Install hook abuse in npm packages.
These packages use npm lifecycle scripts (preinstall, install, postinstall) to run code automatically during npm install, for purposes the package does not need, such as collecting host details or changing global tooling.
Packages
172 packages with LPM's own review, newest scan first. Showing 1–48.
The package automatically transmits identifying host and project metadata during installation to a fixed external endpoint. This is an active install-time disclosure, so the package shoul...
The manifest activates prepare.js during preinstall, and the script fetches and executes remote content. This is concrete install-time remote code execution, so the package should be bloc...
The lifecycle hook activates an automatic DNS disclosure of host-identifying data to an unrelated out-of-band recipient. This is concrete install-time collection and transmission, so the...