npm

Node.js package manager abuse techniques

5 techniques

Dependency confusion exploits the way npm resolves package names by publishing a public package with the same name as a private, …

npm supports lifecycle scripts such as preinstall, postinstall, and preuninstall that execute arbitrary shell commands during package …

.npmrc files control npm behavior including registry URLs, authentication tokens, and script execution settings. An attacker with file write …

npx is a convenience tool that downloads and immediately executes packages from the npm registry without requiring an explicit install step. …

Package hijacking occurs when an attacker gains control of a legitimate maintainer's npm account and publishes trojanized versions of …