Skip to content

.tip

· one of the small things

Turn off install scripts and allow the few that need them

Every npm worm this year ran in a postinstall hook. With scripts off, a poisoned version gets downloaded and then does nothing until your code imports it, which gives you a chance to catch it.

# .npmrc
ignore-scripts=true

pnpm 10 has this on by default, plus onlyBuiltDependencies for the few packages, like sharp and esbuild, that really do need a build step.

securitynpm

Longer version: the post this came from.