postinstall scripts deserve a look

One thing I check more often now: package install scripts.

Not because every package is suspicious. Most are fine. But postinstall, preinstall, maintainer scripts, setup hooks, extension installers, all of that stuff runs at a moment when people are usually not paying attention. They just want the tool installed so they can get back to work.

That is a bad time to hand out trust automatically.

A few habits help:

• read the install script when the package is new to you
• prefer distro packages or pinned versions for important systems
• install random dev tools in a throwaway container first
• watch for curl-to-shell installers that pull more scripts after the first one
• check what files and services got added after install

None of that is glamorous, but it catches real problems. A lot of damage starts with somebody typing yes because the command looked normal.

#security #linux