Install hook abuse in npm packages.
These packages use npm lifecycle scripts (preinstall, install, postinstall) to run code automatically during npm install, for purposes the package does not need, such as collecting host details or changing global tooling.
Packages — page 3
172 packages with LPM's own review, newest scan first. Showing 97–144.
Automatic lifecycle execution bypasses consent in non-interactive contexts and launches a concealed helper that builds and persists a background service outside the package. This is concr...
This is a concealed install-time remote code execution chain, not functionality required for a glob matcher. The automatic execution, opaque payload retrieval, evaluation, and cleanup est...
This is malicious under the install-control-surface policy: postinstall modifies all detected coding-agent configurations without user consent while installing a remote executable payload...