CS Fundamentals Trainer · JavaScript · Security

Why do attackers who publish a typosquatted package (for example lodahs instead of lodash) usually put their payload in a postinstall…

Why do attackers who publish a typosquatted package (for example `lodahs` instead of `lodash`) usually put their payload in a `postinstall` script?

  1. npm runs dependency lifecycle scripts during `npm install` by default, so the code runs on the developer's or CI machine before anything imports the package.
  2. `postinstall` scripts are bundled into the front-end build, so they run in the browser of each user who loads the site afterwards.
  3. `npm audit` skips packages that declare a `postinstall` script, so the malicious package is hidden from vulnerability reports.
  4. Lifecycle scripts run with root privileges even when npm was started by a normal user, giving full control of the machine.

Difficulty: medium

Answer this question

Related questions