Your npm install was safe. What happens when the package runs?

For years, one of the first questions we asked about a suspicious npm package was whether it ran a pre-install or postinstall script. Those hooks can execute before a developer has written a line of code that uses the dependency. Blocking them is a sensible…

Preview courtesy of InfoWorld. The full article opens on their site.