Five real package-lock.json integrity bypass techniques senior DevOps keeps missing, plus a freeze-attest-replay framework to make your lockfile loud instead of polite.
lifecycle script attacks
1 Article
Tactics used by attackers to inject malicious code before integrity verification, including preinstall and postinstall exploitation.