Fix package declares an install-time script in Express

This project's own `package.json` declares `preinstall`, `install`, or `postinstall`. Those run automatically for anyone who installs the package - in CI, in a container, on a teammate's laptop - and they are the mechanism a worm reaches for when it republishes a package. Legitimate for native addons; reported at a lower weight when the script runs a recognised build tool.

medium likely Express CWE-829 / OWASP A08:2021 / ASI ASI04

The vulnerable pattern in Express

This finding comes from the Express fixture in the owlwarden test suite. `postinstall` runs for everyone who installs this package, before any code is reviewed and often inside CI with credentials in the environment. This is the mechanism a compromised package uses to spread.

The corrected handler

Move the work into an explicit script the developer runs (`pnpm setup`), or into the build step. If it genuinely has to run at install time - a native addon - say so in the README and keep the script to the build tool, with no network fetch and no run-time package resolve.

// package.json
"scripts": { "setup": "node scripts/setup.mjs" }

Check your own repository

npx owlwarden scan
npx owlwarden explain install-lifecycle-script

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other Express checks

Rules with a tested Express example.

• cors-permissive medium Cross-origin policy accepts any origin
• hardcoded-secret high Credential hardcoded in source
• insecure-cookie medium Cookie set without its protective attributes
• open-redirect medium Redirect target comes from the caller
• security-headers-missing medium Security headers are not configured
• sensitive-data-logged medium Sensitive data written to a log
• sql-injection high SQL query built by string interpolation
• ssrf high Server fetches a URL the caller controls
• stack-trace-leak high Stack trace leaked in error response
• weak-crypto high Broken cryptographic primitive protecting a secret

install-lifecycle-script for every framework / All rules / owlwarden