Unverified50% confidenceFactExact time
攻击者可利用npm的postinstall脚本机制在包安装时自动执行任意代码
1
Sources
50%
Confidence
Long-term
Relevance
8/18/2026
First Seen
Sources
Related Claims
Unverifiednpm 的 postinstall 脚本机制可以在包安装时自动执行任意代码，无需用户额外操作80% similarUnverifiedPKGBUILD中的prepare()、build()和package()函数执行时拥有当前用户完整权限，install脚本以root身份运行，攻击者可借此不受限制地修改系统65% similarUnverifiedKiro's Hooks automation mechanism allows predefined operations to be automatically executed when events such as saving a file, pre-commit, or creating a new file are triggered64% similarVerifiedThe PostToolUse Hook triggers after a tool operation is completed, and can be used for automatic code formatting, automatically running tests, and automatically reloading services.63% similarUnverified若项目中尚未引入LeakCanary，Profiler可通过单击操作自动将所需依赖注入到构建文件中63% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/766363API
curl https://kongchang.com/api/v1/knowledge/claims/766363MCP
get_claim(id=766363)