NPM Lifecycle Script Change Monitor — Install Script Risk Diff

Monitor public npm package releases and see whether the newest release adds, changes, or removes install-time lifecycle scripts compared with the immediately previous stable release.

What it checks

For each package, the Actor reads public npm Registry metadata for the current dist-tags.latest version and the highest previous stable semver release. It compares only:

• preinstall
• install
• postinstall

It does not download package tarballs, install target packages, or execute lifecycle scripts.

Why this is useful

Install-time scripts can introduce new execution behavior during dependency installation. This Actor gives a factual release-to-release diff so a developer or security team can review that behavior before approving or adopting an update.

The result is a review signal, not a malware verdict.

Input

{
  "packages": ["esbuild", "sharp", "@scope/package"],
  "includeUnchanged": true
}

• packages: 1–50 public npm package names. Scoped packages are supported.
• includeUnchanged: when false, NO_SCRIPT_CHANGE rows are omitted from Dataset but still counted in OUTPUT.

Versions, tags, URLs, private registries, git dependencies and file dependencies are not accepted in v0.1.

Events

• NEW_INSTALL_SCRIPT — a lifecycle script did not exist in the previous release and exists now.
• SCRIPT_CHANGED — the same lifecycle script exists in both releases but its trimmed command text changed.
• SCRIPT_REMOVED — a lifecycle script existed previously and is absent now.
• NO_SCRIPT_CHANGE — none of the three monitored lifecycle scripts changed.

Package-level severity is triage only:

• high — at least one NEW_INSTALL_SCRIPT
• medium — at least one SCRIPT_CHANGED and no new script
• info — only removals
• none — no script change

Dataset example

{
  "package": "example-package",
  "previousVersion": "1.2.0",
  "currentVersion": "1.3.0",
  "event": "NEW_INSTALL_SCRIPT",
  "severity": "high",
  "changedScripts": 1,
  "changes": [
    {
      "script": "postinstall",
      "type": "NEW_INSTALL_SCRIPT",
      "severity": "high",
      "previousValue": null,
      "currentValue": "node setup.js"
    }
  ],
  "previousScripts": {
    "preinstall": null,
    "install": null,
    "postinstall": null
  },
  "currentScripts": {
    "preinstall": null,
    "install": null,
    "postinstall": "node setup.js"
  },
  "checkedAt": "2026-09-16T00:00:00.000Z"
}

OUTPUT

OUTPUT summarizes:

• packages requested / scanned / failed
• packages with lifecycle-script changes
• count of new, changed and removed scripts
• count of packages with no lifecycle-script change
• bounded per-package failures

One missing or unavailable package does not discard successful checks for the rest of the batch. If every package fails, the Actor writes diagnostic OUTPUT and fails the run.

Version comparison behavior

The comparison is release-to-release, not run-to-run:

1. current release = dist-tags.latest
2. previous release = highest valid semver below current
3. prereleases are excluded when current latest is stable
4. if current latest is itself a prerelease, prior prereleases may be compared
5. first releases use an empty previous-script set

No persistent monitoring state is required in v0.1.

Safety and limitations

• Public default npm Registry only.
• No npm authentication.
• No package tarball downloads.
• No npm install of target packages.
• No execution or shell parsing of script values.
• No malware classification, CVE scanning, maintainer monitoring, typosquat detection, license analysis, dependency-tree scanning or lockfile scanning.
• prepare is intentionally excluded for registry-package v0.1; non-registry dependency sources are out of scope.

Use the output as evidence for review. NEW_INSTALL_SCRIPT does not mean a package is malicious, and NO_SCRIPT_CHANGE does not mean a package is safe.

Product expansion rule

v0.1 is the Apify validation product only. If real usage shows demand, the same platform-independent diff core can later support:

• n8n for alert automation
• MCP for agent pre-install checks
• GitHub Action for dependency-update review
• API / CLI for developer and CI workflows

No second adapter is included until real external usage or integration demand exists.

Open-source reference

The product direction was informed by daniellockyer/npm-scan, an MIT-licensed project that demonstrates the value of watching npm publishes for newly introduced install scripts. This Actor independently implements a smaller Registry-metadata diff core and does not copy or vendor that project's implementation.