FrontendHaltSecurity·Advanced·Conceptual·1 min read
What's the risk of postinstall scripts?
Short interview answer
They run arbitrary code automatically during npm install, on developer machines and CI, with the ability to read environment variables, credentials, and the filesystem. Some ecosystems and configurations let you disable script execution by default and allowlist the few packages that genuinely need it.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.