Living Off The Ecosystem
The implicit attack surface. Files, env vars, flags and hooks that run on install, at startup, on import, and when a command starts.
Install time
- npm lifecycle scriptsInstall hook · Node.js
scripts field in package.json - setup.py arbitrary code executionInstall hook · Python
setup.py in source distributions (sdist) - binding.gyp / node-gyp native compilationInstall hook · Node.js
binding.gyp file in the package root - Corepack (packageManager field)File · Node.js
"packageManager" field in package.json, COREPACK_HOME cache directory - .npmrc registry manipulationFile · Node.js
.npmrc file (project, user, or global) - overrides / resolutions dependency swapFile · Node.js
overrides (npm) or resolutions (Yarn) field in package.json - pnpm hooks (pnpmfile.cjs)Install hook · Node.js
.pnpmfile.cjs in the project root - .yarnrc.yml plugins and registryFile · Node.js
.yarnrc.yml in the project root - pyproject.toml build backendsFile · Python
pyproject.toml [build-system] table - node_modules/.hooks/ directoryInstall hook · Node.js · deprecated
node_modules/.hooks/ directory
Interpreter startup
- NODE_OPTIONS preload injectionEnv var · Node.js
NODE_OPTIONS environment variable, CLI flags, or .env files loaded via --env-file - .pth file import executionFile · Python
*.pth files on sys.path (commonly site-packages) - sitecustomize / usercustomize auto-importFile · Python
sitecustomize.py / usercustomize.py on sys.path (usually site-packages)
Module resolution
- .node native addon loadingFile · Node.js
.node files in node_modules/ (typically under build/Release/ or prebuilds/) - Yarn Plug'n'Play (.pnp.cjs)File · Node.js
.pnp.cjs in the project root - __init__.py execution on importFile · Python
__init__.py in any package directory on sys.path - .pyc bytecode cache poisoningFile · Python
.pyc files in __pycache__/ directories alongside source modules - PYTHONPATH / PYTHONHOME module shadowingEnv var · Python
PYTHONPATH / PYTHONHOME environment variables - NODE_PATH environment variableEnv var · Node.js
NODE_PATH environment variable - "imports" field (subpath imports)File · Node.js
imports field in package.json - require.extensions / Module._extensionsModule hook · Node.js · deprecated
require.extensions / Module._extensions in any loaded module - .egg files and EGG-INFO scriptsFile · Python · deprecated
.egg files in site-packages (registered via easy-install.pth) - Zip imports (zipimport)File · Python
.zip / .pyz files on sys.path, or passed directly to the interpreter