Verified75% confidenceFactExact time
npm lifecycle scripts (preinstall, install, postinstall) are automatically executed during npm install and are one of the most commonly abused technical features in supply chain attacks
3
Sources
75%
Confidence
Long-term
Relevance
7/13/2026
First Seen
Sources
jscrambler npm Package Compromised: Supply Chain Attack Incident Response and Protection Guide
redditr/programming7/11/2026
Related Claims
UnverifiedA typical npm release workflow usually includes the following stages: checkout code → install the Node.js environment → npm ci to install dependencies → run tests → run npm version to tag → publish to the registry using the NPM_TOKEN secret.68% similarUnverifiedPlugins installed from npm sources are now fetched using npm pack --ignore-scripts and undergo integrity verification, and the package installation scripts no longer run automatically.66% similarUnverifiednpm allows packages to execute scripts during the install phase (such as postinstall) and does not enforce signature verification by default.64% similarUnverifiedAfter setting npm paths, an .npmrc configuration file is automatically generated in the user directory, recording the current npm configuration items.63% similarUnverifiednpm's prefix determines the storage location for packages installed globally with npm install -g, and the packages will be placed in the node_modules subfolder under the prefix directory.63% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/500923API
curl https://kongchang.com/api/v1/knowledge/claims/500923MCP
get_claim(id=500923)