Fix package declares an install-time script in TanStack Start

This project's own `package.json` declares `preinstall`, `install`, or `postinstall`. Those run automatically for anyone who installs the package - in CI, in a container, on a teammate's laptop - and they are the mechanism a worm reaches for when it republishes a package. Legitimate for native addons; reported at a lower weight when the script runs a recognised build tool.

medium likely TanStack Start CWE-829 / OWASP A08:2021 / ASI ASI04

The vulnerable pattern in TanStack Start

This finding comes from the TanStack Start fixture in the owlwarden test suite. `postinstall` runs for everyone who installs this package, before any code is reviewed and often inside CI with credentials in the environment. This is the mechanism a compromised package uses to spread.

The corrected handler

Move the work into an explicit script the developer runs (`pnpm setup`), or into the build step. If it genuinely has to run at install time - a native addon - say so in the README and keep the script to the build tool, with no network fetch and no run-time package resolve.

// package.json
"scripts": { "build": "vinxi build" }

Check your own repository

npx owlwarden scan
npx owlwarden explain install-lifecycle-script

Runs on your machine. No account, no telemetry, no network unless you ask. In CI, SARIF uploads to code scanning and the exit code is the gate.

Other TanStack Start checks

Rules with a tested TanStack Start example.

• cors-permissive medium Cross-origin policy accepts any origin
• hardcoded-secret high Credential hardcoded in source
• insecure-cookie medium Cookie set without its protective attributes
• open-redirect medium Redirect target comes from the caller
• sensitive-data-logged medium Sensitive data written to a log
• sql-injection high SQL query built by string interpolation
• ssrf high Server fetches a URL the caller controls
• stack-trace-leak high Stack trace leaked in error response
• weak-crypto high Broken cryptographic primitive protecting a secret

install-lifecycle-script for every framework / All rules / owlwarden