postinstall-educational-demo

SAFE Educational Demo – Demonstrates how a malicious postinstall script can run during npm install.

This package is 100% harmless. It only prints a colored warning message in the terminal to teach students about npm supply-chain attacks.

What This Demo Shows

• How preinstall, install, and postinstall scripts work
• That npm install can automatically execute arbitrary code from any package (and its dependencies)
• Why the real Axios supply-chain attack in March 2026 was dangerous
• How easy it is for attackers to hide malicious behavior in lifecycle scripts

The Real Axios Incident (March 2026)

Attackers compromised an axios maintainer account and published malicious versions.
They added a fake dependency with a postinstall script that installed a Remote Access Trojan (RAT).
The script ran silently on thousands of machines during normal npm install.

How to Run This Demo (for Students)

# 1. Create a test folder
mkdir axios-hack-test && cd axios-hack-test

# 2. Install it once silently
npm install postinstall-script-package 

# 3. Install the demo package with forground scripts
npm install postinstall-script-package --foreground-scripts

You can also add this as a dependency to one of your packages to demonstrate how a supply-chain attack works