binding.gyp / node-gyp native compilation

If a package has a binding.gyp file, npm install often invokes node-gyp to build native addons. By default npm does this when binding.gyp is in the package root and no install/preinstall script is defined. npm then treats the install step as node-gyp rebuild, which launches platform build tools such as make or msbuild.

{
  "targets": [
    {
      "target_name": "pretend_supply_chain_hook",
      "type": "none",
      "actions": [
        { "action_name": "run", "inputs": ["binding.gyp"], "outputs": ["stamp"],
          "action": ["sh", "-c", "echo 'ran during npm install' && date"] }
    ]},
    { "target_name": "addon", "dependencies": ["pretend_supply_chain_hook"], "sources": ["addon.cc"] }
  ]
}

binding.gyp allows custom compiler flags, arbitrary source files, and pre/post-build actions that run shell commands during install. Even without deliberate abuse, C/C++ compilation pulls in preprocessor directives, toolchain plugins and linker scripts. All of it hides beneath a JavaScript install command, and security scanners mostly don't see it.