A Sekiya question · Systems & Security
What does an npm install really touch?
An install script is arbitrary code executed at the moment of maximum trust. The package manager asks for approval; it does not describe behaviour. The question is not whether to be afraid of install scripts — it is how to see one.
trace-npm is Sekiya’s instrument for that: run the script under a tracer, keep the record, state what the record cannot show.
Objects bearing on it
| No | Type | Object | Area | Date ↓ | State |
|---|---|---|---|---|---|
| SK-I-01 | instrument | trace-npm | S&S | 2026-08-21 | alpha on npm |
| R-002 | finding | Evidence that exists and cannot be retrieved | S&S | 2026-08-17 | accepted |