🎯 Malicious npm preinstall lifecycle hook

The items that name it 3

• Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks
  writeup2026-08-04

  "preinstall": "node setup.mjs" added to package.json runs automatically during dependency installation without requiring the package to be imported or executed

• Orca Security: Red Hat npm Packages Compromised in Supply-Chain Attack Spreading Credential-Stealing Worm
  article2026-06-02

  A 4.2 MB obfuscated JavaScript payload executes during npm install via the preinstall hook, before any application code runs

• TeamPCP SAP CAP Attack
  writeup2026-05-06

  Modified package.json adds "preinstall": "node setup.mjs" to execute code automatically before application code runs during npm install