Install hook abuse in npm packages.
These packages use npm lifecycle scripts (preinstall, install, postinstall) to run code automatically during npm install, for purposes the package does not need, such as collecting host details or changing global tooling.
Packages — page 2
172 packages with LPM's own review, newest scan first. Showing 49–96.
The package implements an automatic install-time reconnaissance and external callback chain. Its research labels do not establish consent for this behavior.
Automatic lifecycle execution performs unsolicited host and project reconnaissance and transmits it externally. The package's research claim does not remove this concrete install-time exf...
Automatic install-time host reconnaissance and covert transmission to hard-coded external endpoints are concrete malicious behavior. Error suppression and a DNS fallback reinforce the int...