Your npm install Is Doing More Than You Think

The npm install command does more than simply downloading packages. When you type `npm install`, npm performs several actions behind the scenes. These include resolving dependency versions, reading or updating a lockfile, downloading packages, installing dependencies, resolving transitive dependencies, running lifecycle scripts, and potentially building native dependencies. So, `npm install` is closer to "Resolve → Download → Install → Execute lifecycle scripts → Build where necessary" than just "Download files."

Your dependencies are not just the packages you explicitly install. They also include all the packages those dependencies depend on, which are called transitive dependencies. For example, when you install one package, you might end up installing dozens or hundreds of packages indirectly. These transitive dependencies form a trust chain because they can potentially compromise your application, even if you never looked at their source code.

Lifecycle scripts defined in the package.json file are also executed during installation. For instance, a package might define a `postinstall` script to run `node setup.js`. This means that an installation can involve executing code, not just copying JavaScript files into the `node_modules` directory.

While lifecycle scripts can be useful for tasks like compiling native components or generating files, they should not be taken lightly from a security perspective. Installing a dependency can result in code execution during installation, which could lead to security vulnerabilities if the code is malicious.

Although lifecycle scripts are not inherently dangerous, they raise the importance of understanding what code you are trusting when you install a package. Not all npm scripts are malicious, but executing code from your dependency chain requires a more accurate security mindset.