Skip to content

Install-time script execution

Named by 2 kept items in this workspace.

Search every workspace for Install-time script execution. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • FauxUV campaign (Xygeni)
    writeup2026-07-18

    Early versions run PowerShell with -ExecutionPolicy Bypass directly from setup.py during pip install, in the background with errors suppressed so pip appears to succeed normally

  • Socket: npm v12 Ships With Install Scripts Off by Default
    article2026-07-15It is written here as Install-time script execution (preinstall/install/postinstall).

    Malicious code executed via npm lifecycle scripts at install time, before application code loads; used by almost every worm and credential stealer that hit the registry since late 2025

All techniques in this workspace.