Lifecycle Scripts

Most package managers run scripts at install time:

• preinstall — before installing this package's deps
• install — typical native-extension build (e.g. node-sass compiles)
• postinstall — after install (e.g. set up CLI symlinks)

{
  "scripts": {
    "preinstall": "echo Hi",
    "postinstall": "node scripts/setup.js"
  }
}

Scripts are a MAJOR security surface:

• They run shell commands as your user
• They run during dependency installation, not just YOUR code
• A malicious or compromised dep can do anything your shell can

Real attacks:

• eslint-scope (npm 2018): postinstall stole npm credentials
• rc (npm 2018): same, exfiltrated env vars

Defenses:

• --ignore-scripts flag — don't run any (much safer; some packages won't work)
• Sandboxing (yarn 2's strict mode, deno's permissions) — scripts can't access your full system
• Vendored dependencies (Go modules' default approach) — no script runtime

pnpm enables --ignore-scripts by default for transitive deps; only your direct deps get scripts. A reasonable middle ground.

For this lesson: model script execution + ordering.