Getting rid of NPM scripts

by Eric Fortis

In 2016, Sam Saccone, from Google, discovered a vulnerability that allows adversaries to run arbitrary scripts when installing an NPM package of theirs. As mitigation, NPM co‑founder Laurie Voss suggests:

  • Option 1: using npm install --ignore-scripts
  • Option 2: adding ignore-scripts=true to .npmrc

I prefer the latter, so I don’t have to remember the flag. But for that, we will need something to replace NPM scripts. For example, a Makefile.

Update 2021: Before NPM v7, enabling ignore‑scripts disabled NPM scripts. After v7, mentioned flag no longer disables them; it only prevents the life cycle scripts, which are the attack surface of the vulnerability.

Update 2022: Feross Aboukhadijeh, discovered a vulnerability when running NPM scripts. Therefore, we need an alternative again.


all: test lint slint build

	sh -c "time ./make-production.js"

	rsync --times ./dist server-a:/home/www

	mocha "src/**/*.test.js"
	eslint src
	stylelint "src/**/*.css"

.PHONY: test lint slint build install all
$ make test

If the package is not globally installed, you can prefix the path:

	node_modules/.bin/eslint src

Overriding at installation

If you need packages that install binaries, or rely on running an NPM script, temporarily override the mitigation:

$ npm install --ignore-scripts=false package-i-trust

Or, trigger the installation script:

$ node node_modules/puppeteer/install.js 

Overriding a project

If you can’t follow the above recommendations for certain project, instead of allowing scripts globally, create an .npmrc file next to the package.json with the following line:



Discussion at Hacker News.

Sponsored by: