Repository navigation
How to have ignore-scripts=true but still have prepare script run in own package on publish? #8698
Description
I want to have ignore-scripts=true in my global .npmrc for security reasons, but I still need to publish packages that need to build TypeScript code on publish. This worked until v11, which includes:
--ignore-scripts now applies to all lifecycle scripts, include
prepare
However, I still need the local prepare script to run on publish. Otherwise, there is no way to have TypeScript code built automatically when running npm publish, unless I'm missing something?
I understand to desire to have ignore-scripts=true apply to everything, but there needs to be a solution for publishing packages.
Activity
nikunj-kohli commentedon Oct 28, 2025
I would like to contribute here, I request you to assign me
Standard8 commentedon Mar 31, 2026
This was introduced by #7800.
We are considering using the
ignore-scripts=trueon our repositories to help improve security (e.g. against post-installs scripts being injected), but like the reporter, we haveprepack/prepublishscripts that need to run for some cases, so globally turning off scripts breaks those workflows.I think the ideal solution would be that
ignore-scriptswas a tri-stateall,installoroff(or something like that), however, that would be a breaking change, though maybe we could also allowtrueandfalseboolean values (not sure how the code works).The alternative would be some kind of second variable e.g.
allow-publish-and-pack-scriptsto allow those scripts when we need them.@wraithgar apologies for the tag, but I see you reviewed the original issue. What would be the way forward here? Does this need an RFC?
I'm not sure I'd have time to work on it, but I'm hoping to at least get the discussion started.
jorenbroekema commentedon Apr 16, 2026
This would be quite helpful for us as well.
As far as I understand (and please correct me if I'm wrong), the primary vector of attack of supply chain attacks via npm scripts hooks, are via
npm installor similar likenpm ci, because it fires the following hooks (from the docs https://docs.npmjs.com/cli/v8/using-npm/scripts#life-cycle-operation-order):not just from your package.json but also the pre/post scripts in the package.json's of all of the installed dependencies, allowing the execution of potentially malicious third-party scripts. Or is that only true for
postinstall?That said, it seems like pre/post hooks for other npm lifecycle hooks don't suffer from that same vulnerability (again, correct me if I'm wrong here), and should still be allowed? As a platform engineer in our company, forcing
ignore-scripts=truein all CI/CD pipelines would be quite harsh on all of the projects that make use of such hooks, e.g. prepublishOnly being quite common.Edit: would also be fine if there was a
--ignore-dependencies-scripts, allowing self and workspace-self scripts to still run, but not those of dependencies.wraithgar commentedon Apr 23, 2026
This is the very problem we are discussing in npm/rfcs#861