Malicious npm preinstall hook

Named by 3 kept items in this workspace.

Search every workspace for Malicious npm preinstall hook. It matches the name as written, so it can find other things that share it.

The items that name it 3

Tensorlake npm package compromised by Shai-Hulud in latest software supply chain attack | Blog | Endor Labs
advisory2026-10-08
Package manifest preinstall hook runs node lib/setup.mjs, executing automatically on npm install before application code
Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It
writeup2026-10-08
setup.mjs runs on package install via preinstall script, skips execution on CI to target developer machines only
jscrambler npm Package Compromised in Supply Chain Attack
writeup2026-07-11
Versions 8.14.0, 8.16.0, 8.17.0 added an undocumented preinstall hook ('preinstall': 'node dist/setup.js') that runs code automatically during npm install before any application code runs

All techniques in this workspace.