Misbehaving packages/dependency attack using npm postinstall Default authority Read-write authority to read the current directory ($PWD). Designation bundled with authorization.