Preinstall script execution
Named by 3 kept items in this workspace.
Search every workspace for Preinstall script execution. It matches the name as written, so it can find other things that share it.
The items that name it 3
Malicious package triggers payload via a preinstall script invoking node lib/setup.mjs.
Second wave (November 2025) moved execution to the pre-install step, widening blast radius across developer machines and CI pipelines
Malicious preinstall scripts automatically invoked a malicious index.js file during npm package installation
All techniques in this workspace.