@gkiely/safe-install: npm Package for Trusted Dependency Installs with Locked-Down Lifecycle Scripts
By
gkiely
A snack-sized bagel for a snack-sized appetite.
Summary
@gkiely/safe-install is an npm package that allows developers to run npm installs with dependency lifecycle scripts disabled by default, then selectively rebuild only explicitly trusted packages. It addresses the security risk of npm lifecycle scripts (postinstall, install, preinstall) that can run arbitrary code during installation, while still supporting packages that legitimately need these scripts for building native bindings or downloading binaries. The package keeps default installs locked down and moves script execution to a controlled, trust-based workflow.
Key quotes
· 3 pulledRun npm installs with dependency lifecycle scripts disabled by default, then rebuild only the packages you explicitly trust.
npm lifecycle scripts can run arbitrary code during install.
This package keeps the default install locked down and moves script execution to a controlled, trust-based workflow.
You might also wanna read
Anthropic Releases Free Security Plugin for Claude Code Terminal to Detect Vulnerabilities
Anthropic has released a free security-guidance plugin for its Claude Code terminal tool that autonomously reviews code edits, model outputs
cybersecuritynews.com·4h ago
wolfCOSE: A Lightweight COSE + CBOR Library for Embedded Systems with PQC and FIPS 140-3 Support
wolfCOSE is a lightweight C library implementing CBOR (RFC 8949) and COSE (RFC 9052/9053) for embedded systems, using wolfSSL as the crypto
github.com·1d ago
Anthropic launches Claude Security beta for codebase vulnerability scanning
Anthropic has released Claude Security, a defensive security tool within Claude Code on the web, from closed preview to beta for Claude Ente
thenewstack.io·1d ago
How LinkedIn's 2012 Breach Exposed the Dangers of Unsalted Password Hashes
This article examines the 2012 LinkedIn breach where attackers cracked millions of passwords using fast, unsalted hashes like MD5 and SHA-1.
hendryadrian.com·1d ago
AI-Generated npm Package Leaks Its Own GitHub Token, Exposing Malware Operator
A malicious npm package named mouse5212-super-formatter, identified by OX Security, was caught leaking its own hardcoded GitHub token. This
infosecurity-magazine.com·1d ago
How a botnet abused my open source project's cloud version to phish 14,000 people
The author, who runs an open source project management tool called Kaneo, discovered that a botnet had abused the hosted cloud version of th
andrej.sh·2d ago