'How does npm behave differently with ignore-scripts set to true?

I just watched a talk where the speaker recommended running:

npm config set ignore-scripts true

so that post-install scripts and pre-install scripts of a package don't run. That way, you would avoid a virus in a malicious package.

My question is: After running this command, must I do anything differently to npm install packages and get them to work within a project?

If running this command comes with no additional inconvenience when using npm, then running it would have no downside. It would only help you avoid viruses.

If this was the case, why wouldn't this be the default setting?

I ask because I assume that by ignoring package scripts, npm packages would behave differently and one would have to do more things manually.

node.jsnpmnpm-scripts


Solution 1:[1]

If you want to be safe, use '--ignore-scripts' or the config setting, but also use can-i-ignore-scripts.

It helps you find out which scripts exist (especially when you install new dependencies), but prevents automatically executing new scripts which appear with a new version of a library you already use.

Solution 2:[2]

I agree with @RobC here. It also disactivated running custom scripts in my package.json completely for me, which obviously is a deal breaker since you can't define and run your custom scripts anymore.

Although it's probably useful to think about these security concerns, I don't think running npm config set ignore-scripts true is the right option. I ran it as well and ended up turning it back off to keep running my custom package scripts.

So the advice from the video ended up being not all too sound, I guess...

Solution 3:[3]

I faced a similar problem when some dependencies need running scripts to build platform-specific code with node-gyp.

Would be nice to have an option in ignore scripts per project to enable specific ones to build.

So far decided to stay on ignore-scripts = true globally in .npmrc and using an extra script in my project that basically does this:

#!/bin/bash
set -e

npm explore sqlite3  -- yarn run install
npm explore bcrypt   -- yarn run install

p.s. yarn does not have explore

Solution 4:[4]

Although it's probably useful to think about these security concerns, I don't think running npm config set ignore-scripts true is the right option

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source
Solution 1 JSchirrmacher
Solution 2 Leon Tepe
Solution 3 Andrew
Solution 4 Kavinda Senarathne

Related Questions