Block install-time scripts except for an allowlist

Description

Package lifecycle scripts that run at install time (pre-install, post-install, build hooks) are disabled by default. Only packages on an explicit, reviewed allowlist may run them.

Rationale

Most malicious packages do their work in an install hook: they steal tokens and keys from the environment the moment the package is installed, without ever being imported by the application.

Impact

Packages that compile native code or download binaries at install time break until they are added to the allowlist or replaced.

Audit

1. Check that install-time scripts are disabled in committed package manager configuration.
2. Review the allowlist: each entry must have a reason.
3. Check that pipelines do not re-enable scripts with a flag.

Automated: every check must pass. Scanners report each check by its id.

postmortem

script policy of npm, pnpm, yarn, bun and composer plugins

command: postmortem harden --json
control: CB-DEP-EXEC-001
coverage: auto

Remediation

1. Disable install-time scripts in committed configuration.
2. Run an install, list the packages whose scripts were skipped, and allowlist only those needed.

References

• Package Manager Best Practices OpenSSF, guide, accessed 2026-10-16
• Secure Supply Chain Consumption Framework (S2C2F) OpenSSF, guide, accessed 2026-10-16

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEP-EXEC-002 Prefer prebuilt packages over packages built from source at install
• related CB-DEP-CI-001 Install dependencies in a step without secrets

People and lifecycle