Node.js · Middle · Question 68 of 75
What is a risk of postinstall scripts in dependencies?
- ✓Correct answer: They run arbitrary code on your machine or CI during install, which supply-chain attacks use
- 2They slow down
nodeat runtime - 3They delete the lock file
Explanation
Pin versions with a lock file, review new dependencies and consider --ignore-scripts or an allow list for packages that really need install scripts.