Living Off The Ecosystem

The implicit attack surface. Files, env vars, flags and hooks that run on install, at startup, on import, and when a command starts.

/

Install time

Runs while dependencies download and build. The app has never started.

8

npm lifecycle scriptsInstall hookscripts field in package.json
binding.gyp / node-gyp native compilationInstall hookbinding.gyp file in the package root
Corepack (packageManager field)File"packageManager" field in package.json, COREPACK_HOME cache directory
.npmrc registry manipulationFile.npmrc file (project, user, or global)
overrides / resolutions dependency swapFileoverrides (npm) or resolutions (Yarn) field in package.json
pnpm hooks (pnpmfile.cjs)Install hook.pnpmfile.cjs in the project root
.yarnrc.yml plugins and registryFile.yarnrc.yml in the project root
node_modules/.hooks/ directoryInstall hook · deprecatednode_modules/.hooks/ directory

Interpreter startup

Runs while the interpreter boots, before your entrypoint.

1

NODE_OPTIONS preload injectionEnv varNODE_OPTIONS environment variable, CLI flags, or .env files loaded via --env-file

Module resolution

Runs on import or require, for every module the app loads.

5

Invocation / runtime

Runs when someone invokes a command or tool, with full process permissions.

1

npx / npm exec remote executionCLI flagnpx, npm exec, npm create / npm init (initializer flows)