Anatomy of a Malicious Package: The Install-Time Playbook

Thu, 11 Jun 2026 00:00:00 +0000

Installing a dependency runs code. That one fact is the whole attack surface of the software supply chain. A postinstall hook, a setup.py, a build.rs, or a .pth file gives npm install or pip install a place to execute whatever the author wrote, on your laptop or your CI runner, before you have read a line of it.

Attackers know it, and their techniques have converged into a small, recognizable playbook. Detection stays hard, but rarely because the risky primitive is hard to spot. Downloading a binary and running it, reading a file from a home directory, spawning a shell: dozens of legitimate packages do all of these every day. Each malicious technique has a benign twin, and the rest of this post walks through both.

Research on Tolmo

Anatomy of a Malicious Package: The Install-Time Playbook