Web Security · Senior · Question 50 of 75

Why are npm `postinstall` scripts a supply chain risk?

✓Correct answer: They run arbitrary code on developer machines and CI as soon as a package is installed
2They make node_modules larger
3They only run on Windows

Explanation

Many real attacks steal tokens through install scripts. --ignore-scripts with an allowlist for packages that truly need them reduces the risk.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.