Postinstall scripts are reviewed and safe

Postinstall scripts execute arbitrary shell code with your user's filesystem and network permissions the moment anyone runs npm install. This is the mechanism behind several real supply chain attacks — including the event-stream incident — where a legitimate package was transferred to a malicious maintainer who added a postinstall that harvested crypto wallets. OWASP A08 (Software and Data Integrity Failures) covers exactly this failure mode. CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) and CWE-114 (Process Control) both apply when a package executes code you have not reviewed. SSDF PW.4 requires that third-party components be vetted. A postinstall script making network requests to an unrecognized host should be treated as a confirmed incident, not a warning.

Before installing any unfamiliar package with a lifecycle script, inspect its source:

# View the package tarball contents without installing
npm pack package-name --dry-run
# Or inspect the published source at:
# https://www.npmjs.com/package/package-name?activeTab=code

For CI environments where postinstall scripts from known-safe packages are the only expected hooks, add ignore-scripts=true to .npmrc and explicitly enable only those you've reviewed. Never allow a postinstall script that fetches from an external URL without a documented, reviewed justification.