How to avoid running third-party scripts with npm, pnpm and yarn

When you install a Node.js project, there's a very common reflex:

npm install

This command seems harmless. It simply downloads the dependencies listed in the package.json.

But in reality, npm can also execute code during installation.

Many developers are unaware of this, but some packages contain scripts that run automatically during installation. And in some cases, these scripts can cause problems: unexpected behavior, heavy downloads… or worse, malicious scripts.

Fortunately, npm offers a simple option to avoid this:

npm install --ignore-scripts

This option prevents npm from executing the scripts defined in dependencies.

Scripts automatically executed by npm

In a package.json, a package can define several scripts.

For example:

{
  "scripts": {
    "postinstall": "node build.js"
  }
}

npm can automatically run certain scripts during installation.

The most common ones are:

• preinstall
• install
• postinstall
• prepare

These scripts are often used to compile native code, download binaries, generate files needed by the package, prepare assets, etc…

The problem is that npm executes these scripts automatically, without asking for your opinion.

The risk: executing code without knowing it

The npm ecosystem is huge. There are now more than two million packages.

And as in any open ecosystem, some packages turn out to be malicious or compromised.

Several incidents have already occurred:

• abandoned packages taken over by malicious actors
• dependencies injecting spyware code
• scripts sending system information

postinstall scripts are particularly sensitive, as they run directly on your machine at the time of installation.

Specifically, an npm script can:

• access your file system
• read environment variables
• send data over the Internet
• modify your configuration

In other words: a simple npm install can execute arbitrary code.

Using ignore-scripts to keep control

To avoid this, npm offers a very simple option:

npm install --ignore-scripts

With this command:

• npm downloads the dependencies
• npm installs them in node_modules
• but no script is executed

This blocks:

• preinstall
• install
• postinstall
• prepare

Packages are installed without executing any external code.

⚠️ Warning: --ignore-scripts blocks absolutely all scripts.

It is not possible to disable only postinstall or a specific script.

If you use this option, no lifecycle script will be executed, regardless of the package.

This option is particularly useful in several situations:

• dependency auditing
• analyzing an unknown project
• secure environment
• CI/CD pipeline
• installing untrusted dependencies

Equivalent with pnpm and yarn

If you use another package manager, know that similar options exist.

pnpm

pnpm offers exactly the same option:

pnpm install --ignore-scripts

The behavior is identical to npm: dependencies are installed but no lifecycle script is executed.

Yarn

With Yarn (v1 or v3), the option is also available:

yarn install --ignore-scripts

As with npm and pnpm, this blocks the execution of preinstall, install and postinstall scripts.

In other words, the three main Node.js package managers offer this security mechanism.

Re-enabling scripts if necessary

If a package actually needs its scripts to work, you can rerun them later.

For example:

npm rebuild

Or simply rerun the installation normally:

npm install

The advantage is that you keep control over what runs on your machine.

In an ecosystem as vast as npm, this small option can prevent many problems.