Unverified50% confidenceFactExact time
npm 的 postinstall 脚本机制可以在包安装时自动执行任意代码，无需用户额外操作
1
Sources
50%
Confidence
Long-term
Relevance
8/18/2026
First Seen
Sources
Related Claims
Unverified攻击者可利用npm的postinstall脚本机制在包安装时自动执行任意代码80% similarUnverifiedContinuous delivery means the software can be released at any time but the decision is made by a human, whereas continuous deployment means code is automatically deployed after every commit with no manual intervention required throughout the process.61% similarUnverifiednpm的依赖管理机制允许同一个包的不同版本在同一项目中共存，每个依赖项维护自己的node_modules子目录61% similarVerifiedThe PostToolUse Hook triggers after a tool operation is completed, and can be used for automatic code formatting, automatically running tests, and automatically reloading services.59% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/767532API
curl https://kongchang.com/api/v1/knowledge/claims/767532MCP
get_claim(id=767532)