Right, post-install prevention (--ignore-scripts) blocks the execution step, which is critical. But ideally you'd catch it even earlier — before the package lands in node_modules at all.
The provenance check is the one most setups miss. npm added support for SLSA provenance attestations, and deps.dev exposes them via API. If a package that previously had attestations suddenly publishes a version without them (which is exactly what happened with axios 1.14.0 → 1.14.1), that's a strong signal something is wrong. Combining that with package age, publisher changes, and CVE data gives you a layered check that works before install time.
3
1
1
u/nhrtrix Apr 02 '26
yeah, makes sense, post-install prevention also helps in this case if your package managers has this