Source code
Security & compliance
Releases
postinstall script in unknown dep
Part of the Dependency supply chain check · fix arrives as a guide
What it is
A dependency — often a transitive one you did not choose — runs a postinstall, preinstall, or prepare script during install.
Why it matters
Those scripts execute arbitrary code with whatever the install has: your CI credentials, your registry token, your developer machine. It is the shortest path from a compromised package to a compromised pipeline.
How to fix it
Audit what the script does. Install with lifecycle scripts disabled (--ignore-scripts) and allow-list only the packages that genuinely need them, which is usually a small set of native builds.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.