Disable scripts

Description:
It would be nice to be able to configure npm to ignore pre and postinstall scripts.

Justification:
Pre/postinstall scripts are a potential security problem.

Are you willing to submit a PR?
Yes, see #955

@jksolbakken

Hello @jksolbakken, Thank you for creating this feature request and we will get back to you once we have some feedback :)

Some example uses as https://github.com/actions/setup-node/blob/main/docs/advanced-usage.md#use-private-packages give good reasoning why, but most importantly it also shows how to run the postinstalls via rebuild in a next step without the secrets. I like that approach a lot.

Navigation Menu