Node脚本生命周期钩子治理（preinstall-postinstall-安全门禁）最佳实践

**核心要点** - 钩子白名单与禁用列表；默认禁止 `preinstall`/`postinstall`，仅允许受控 `prepare`。 - 检测危险特征：网络下载、代码注入、进程执行与敏感环境访问。 - 审计输出命中规则与证据，支持例外审批与到期。 **实现示例** ```ts type Scripts = { [k: string]: string } const allowHooks = new Set(['prepare']) const denyHooks = new Set(['preinstall','postinstall']) function suspicious(cmd: string): boolean { const r = [ /(curl|wget)\s+https?:\/\//i, /powershell\s+(Invoke-WebRequest|iwr)\s+/i, /node\s+-e\s+/i, /eval\(/i, /Function\(/i, /child_process/i, /require\(['"]child_process['"]\)/i, /process\.env\.[A-Z_]+/, ] return r.some(rx => rx.test(cmd)) } function validateScripts(scripts: Scripts, exceptions: Map, now: number): { ok: boolean; errors: string[] } { const errors: string[] = [] for (const [k, v] of Object.entries(scripts)) { const key = `hook:${k}` const until = exceptions.get(key) || 0 if (denyHooks.has(k) && until < now) errors.push(`denied:${k}`) if (!allowHooks.has(k) && !denyHooks.has(k) && suspicious(v) && until < now) errors.push(`suspicious:${k}`) } return { ok: errors.length === 0, errors } } ``` **审计与CI门禁** - 构建前解析 `scripts` 字段；命中禁用或可疑规则即阻断并输出详情。 - 对必要钩子启用例外审批与到期时间；产线默认拒绝未审批项。