Inspect package behavior

A package name and download count are not a security review. Look at what the package can do during install and runtime.

The npm registry lets any package define lifecycle scripts like preinstall and postinstall. These run arbitrary code on your machine, or in CI, the moment you install. A color-formatting package looks harmless at runtime but defines a postinstall script. During CI installation, that script can read environment variables and make network requests with the job token still present.

Inspect a package before adding it:

npm pack kleur --dry-run
npm view kleur scripts dist.integrity repository

The first command lists exactly which files the published tarball contains, without installing anything. The second shows the declared lifecycle scripts, the integrity hash, and the linked repository. If scripts prints nothing, the package runs no code at install time.

Inspect the exact published archive, not just the GitHub page. Repository source and packaged files can differ: the 2018 event-stream attack shipped malicious code only in the published tarball. Registry popularity cannot reveal that.

Find install scripts already in your tree

You can query your installed graph for packages with install-time hooks:

npm query ":attr(scripts, [postinstall])"

This prints every installed package that declares a postinstall script. Each one is code that executes with your CI job’s authority on every fresh install.

Check the name and the people

Typosquatting is real: in 2017 a package named crossenv mimicked the popular cross-env and harvested environment variables via its install script. Read the name character by character before you install.

Then check who maintains it. Look at maintainer changes, recent release cadence, unresolved security reports, and whether the repository link actually points to the code you think it does. A tiny convenience package with broad install-time authority may cost more risk than a few local lines.

Inspect the published files, lifecycle scripts, maintainers, repository link, and integrity metadata for one real dependency. Save the command output and name every install-time capability you find. Then test the review method on a package with a lifecycle script or bundled native binary.