Transitive check for pre-post install scripts

[shivankar-madaan]

Hello Team,
I was very interested in the pre/post install script check. But I have question, whether npq detects this in the transitive dependencies.

For ex: As an attacker I would create package X , without any pre/post install scripts, but I define that package X also depends on package Y (which is also created by me/attacker) and this package Y actually contains the malicious pre/post scripts . Does npq in such scenario detects this?

So me as an attacker would try to define two packages to bypass pre/post install check. Please advice

[lirantal]

Unfortunately, I didn't get to implement that in transitive dependencies, only in the direct package you install. Happy to receive and merge a PR to add this capability if you're planning to work on that 🙏🏽