SG-082: NPM Install-Hook Dropper

Severity: HIGH

package.json with preinstall/install/postinstall/prepare hook that runs a local JS/TS/PY/SH file

Fires when

A package.json install hook (preinstall/install/postinstall/prepare/prepublish) runs a local script file (node/python/bash/... a .js/.ts/.py/.sh), not a normal build tool.
Severity escalates to CRITICAL when the package name is within Levenshtein distance 2 of a popular npm package (a typosquat).

Related CVEs

CVE-2026-21852

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.

Research