npm

Node.js package manager abuse techniques

5 techniques

Dependency confusion exploits the way npm resolves package names by publishing a public package with the same name as a private, …

npm packages can define lifecycle scripts such as preinstall, install, postinstall, and prepare. npm 11 and earlier normally ran dependency …

.npmrc files control npm behavior including registry URLs, authentication, TLS checks, and install-policy settings. An attacker with write …

npx can install a package into the npm cache and execute its declared binary without adding it to the current project's dependencies. In npm …

Package hijacking occurs when an attacker gains control of a legitimate maintainer's npm publishing authority and publishes trojanized …