npm postinstall script abuse in AI coding environments
Malicious npm packages use postinstall scripts to execute arbitrary code during installation. In AI coding environments, these scripts can modify agent configuration, install backdoor MCP servers, or exfiltrate project secrets — all before the developer reviews the package.
Key facts
npm postinstall script abuse in AI coding environments is a critical-severity AI agent security threat targeting npm postinstall scripts, package.json dependencies, agent configuration files, project .env files. Use Guard package-script controls to review supported npm, pnpm, yarn, and Bun lifecycle scripts before they execute locally. Keep lockfiles and pinned dependencies, and review any newly introduced install script.
What happens
An attacker publishes a malicious npm package (or compromises a popular one) that includes a postinstall script. When the package is installed — often as a transitive dependency — the script runs automatically with the user’s permissions, before anyone reviews the code.
How the attack unfolds
What it looks like in practice
A developer runs npm install to add a charting library. A transitive dependency called "chart-utils" includes a postinstall script that reads the project’s .env file and sends its contents to an attacker server. The developer never sees the script because it runs in the background. The next day, the team’s API keys are used from an unfamiliar IP address.
Detection and Guard coverage
How to stop it
Use Guard package-script controls to review supported npm, pnpm, yarn, and Bun lifecycle scripts before they execute locally. Keep lockfiles and pinned dependencies, and review any newly introduced install script.
Related threat guides
Use the protections Guard supports here
Guard can review or block supported actions for this threat. The advisory above calls out what Guard covers and where other controls are still needed.