A post-install script is a command that runs automatically after a software package is installed. In package managers such as npm, it is often defined in package metadata and may execute with the permissions of the user, developer workstation, or CI runner performing the install. Because it can run code on the host, a post-install script turns installation time into an execution point, not just a file-copy step.
This matters in cyber security because attackers can hide malicious behavior inside trusted-looking packages and trigger it when dependencies are installed. That makes package metadata part of the attack surface in supply-chain incidents. Defenders should inspect lifecycle scripts, restrict or disable automatic script execution where possible, and isolate installs in low-privilege or sandboxed environments. Treating package manifests as executable logic helps prevent hidden commands from running during dependency installation.