test: add postinstall canary script to package.json #17
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,8 +1,8 @@ | ||
| { | ||
| "name": "test-pkg", | ||
| "version": "1.0.0", | ||
| "scripts": { | ||
| "postinstall": "echo CANARY_MARKER > /tmp/postinstall-canary.txt" | ||
| }, | ||
|
There was a problem hiding this comment. Test script removed while test files still existMedium Severity The   Reviewed by Cursor Bugbot for commit 5e99cc6. Configure here. |
||
| "dependencies": {} | ||
|
There was a problem hiding this comment. Removal of
|
||
| } | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Postinstall script is test code committed to production
High Severity
The
postinstallscript writing a canary marker file to/tmp/postinstall-canary.txtis test/debugging infrastructure that executes a shell command on everynpm install. This runs automatically for anyone installing this package or its dependents, writing to the filesystem as a side effect of installation. Even if created for "dependency installation behavior testing," this has no place in the committedpackage.json.Reviewed by Cursor Bugbot for commit 5e99cc6. Configure here.