Source code Security & compliance Releases

postinstall script in unknown dep

Part of the Dependency supply chain check · fix arrives as a guide

What it is

A dependency — often a transitive one you did not choose — runs a postinstall, preinstall, or prepare script during install.

Why it matters

Those scripts execute arbitrary code with whatever the install has: your CI credentials, your registry token, your developer machine. It is the shortest path from a compromised package to a compromised pipeline.

How to fix it

Audit what the script does. Install with lifecycle scripts disabled (--ignore-scripts) and allow-list only the packages that genuinely need them, which is usually a small set of native builds.

Run them all on your app

Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.