Home / Knowledge hub / Install script risk
Knowledge hub
Install script risk
Code a package runs automatically the moment you install it.
What it means
Some packages can run code automatically during installation. In npm, scripts named preinstall, install and postinstall run when you install a package. Python packages built from source can run code from setup.py. This is meant for compiling native code and setting things up. Both are normal features, used by many honest packages.
The same feature lets a hostile package run commands the moment it is installed, before you have imported it or looked at it. The code runs with the rights of whoever ran the install. That is why install is a risky moment.
Why it matters
Developer laptops and build servers often hold cloud keys, tokens and signing credentials. Install-time code can read them and send them out. Several npm campaigns have used install scripts for exactly this, so the first sign is a stolen secret and not a visible bug. A laptop or build server that holds the keys to production makes a rewarding target, and an install script needs only a moment on it. Treat the install step as running code from strangers.
It makes malicious packages and typosquatting more dangerous, because a single mistyped name is enough. Your build pipeline is a high-value place for this to happen. Without the script step, a bad package still has to wait to be run, which gives scanners and reviewers a chance to catch it first.
How it shows up
You can run npm with --ignore-scripts, or set it in configuration, and allow scripts only for the few packages that need them. Some package managers now block dependency scripts by default. Install in a clean build environment with the fewest secrets available.
Review new dependencies before adding them, pin versions with a lockfile, and watch for updates that suddenly add a script. A common mistake is giving the install step production credentials. Anything that runs there should be treated as untrusted code.
Questions people ask
Install script risk, answered
Which package managers run install scripts?
npm and compatible tools run lifecycle scripts by default. Python source distributions can run build code. Wheels, the prebuilt format, do not run setup code on install.
Behaviour differs by tool and version, so check yours.
Does --ignore-scripts fix the problem?
It stops install-time scripts, which removes one route. The package can still run harmful code later when your app imports it.
Combine it with review, pinning and limited secrets. Review is still needed.
Why do legitimate packages use install scripts?
Mostly to compile native code, download prebuilt binaries or set up files. These are real needs.
The few packages that need scripts can be allowed one by one. Allow those by exception.
How would we notice a bad install script?
Rarely by looking at the app. Watch for new scripts appearing in a dependency update, unexpected network calls during builds, and alerts from package scanners.
Short-lived build runners limit what can be taken.
Should build servers have secrets during install?
As few as possible. Fetch dependencies in a step without deployment keys, then use secrets only in later steps.
This way an install script finds nothing worth stealing. Rotate any that were present.
Sources
Where this comes from
Related
Terms that sit next to this one
Malicious package
A published library built to steal data or run code on whoever installs it.
Typosquatting
Publishing a package with a near-identical name, hoping a developer installs it by mistake.
Dependency confusion
Tricking a build into fetching a public package that shares a private package's name.
Build pipeline compromise
An attacker altering your build system so every release carries their code.
Secrets management
Keeping keys, passwords and tokens out of code and in a vault.
What ran before you looked?
Install-time risk sits in your build tooling, outside the running app. Cyberlop tests the deployed app and its APIs and reports only what it exploited, with proof. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.