v1.0.23

Dockerfile

@@ -75,9 +75,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && rm -rf /var/lib/apt/lists/* \
     && cp "$(dpkg -L libnss-wrapper | grep 'libnss_wrapper\.so$')" /usr/local/lib/libnss_wrapper.so
 
-# Copy package files and install dependencies
+# Copy package files and install dependencies (--ignore-scripts blocks malicious postinstall hooks)
 COPY package.json package-lock.json ./
-RUN npm ci
+RUN npm ci --ignore-scripts \
+    && npm rebuild better-sqlite3 argon2
 
 # Copy source code and build
 COPY . .
@@ -85,7 +86,8 @@ RUN npm run build
 
 # Production dependencies only (rebuilds native addons like better-sqlite3)
 RUN rm -rf node_modules \
-    && npm ci --omit=dev \
+    && npm ci --omit=dev --ignore-scripts \
+    && npm rebuild better-sqlite3 argon2 \
     && rm -rf node_modules/@types
 
 # Build Go collector