Security researchers highlight risks in npm and pnpm package execution

Security analysis reveals that traditional defenses against malicious npm packages, such as blocking lifecycle scripts via the ‘ignore-scripts’ setting, may be insufficient. While preventing pre-install or post-install scripts mitigates immediate risks during installation, malicious code can remain dormant until the application calls specific functions during runtime.

A recent campaign involving a malicious package imitating the ‘sorted-btree’ library demonstrated this vulnerability. The package avoided malicious install hooks, instead embedding its payload within a standard method, ‘BTree.prototype.set’. The malicious behavior was only triggered when the application reached a specific condition during normal use, bypassing installation-time security policies.

Further research into package managers like pnpm shows that even with new security features like ‘approve-builds’, other execution surfaces remain unprotected. For instance, the ‘pnpmfile.cjs’ hook runs on every installation regardless of approval settings. Additionally, vulnerabilities in how npm handles configuration files can lead to the exposure of registry credentials through environment variables during script execution.