Install hook abuse in npm packages.
These packages use npm lifecycle scripts (preinstall, install, postinstall) to run code automatically during npm install, for purposes the package does not need, such as collecting host details or changing global tooling.
Packages — page 4
172 packages with LPM's own review, newest scan first. Showing 145–172.
This is a concrete install-hook supply-chain mechanism, not a normal transparent setup step. It remotely replaces executable package code and package metadata during installation.
This package uses an automatic lifecycle hook to install external code globally and stage opaque remote executables for later execution without integrity verification. That is concrete in...
This package contains an install-time path that can mutate a remote database's authorization state and consumer project files. The opt-in environment gate reduces accidental activation bu...