Yes. According to the npm documentation, npm install runs the install lifecycle scripts of the packages it installs, including preinstall, install and postinstall. So a new dependency can execute code on a developer machine or CI runner before your own code ever runs. Review any package that adds or changes those scripts.
Which scripts run
The npm scripts page lists the events that run on install: preinstall, install, postinstall, prepublish, preprepare, prepare and postprepare. It also says npm ci runs the same set after modules are installed into node_modules. If a package has a binding.gyp file and no custom install or preinstall script, npm runs node-gyp rebuild.
The page says install scripts are run from the scripts of the package being installed. That is the reason a dependency matters: its scripts run during your install.
What to check in a pull request
| Signal in the diff | Question to ask |
|---|---|
| A new package with a postinstall entry | What does the script do, and why is it needed? |
| A version bump that adds a script the old version lacked | What changed between versions? |
| A script that downloads or runs a remote file | Is the source pinned and verifiable? |
| A script that reads environment variables or tokens | Why does an install need credentials? |
| A native build step | Is compiling expected for this package? |
How to look
- Find the package in the lockfile and note the old and new versions.
- Open the package's manifest at both versions and compare the scripts section.
- If a script file is referenced, read it. Short ones are quick to scan.
- Search the script for network calls, shell execution and access to home directory files.
- Decide whether the package is worth the risk for what it provides.
{
"scripts": {
"postinstall": "node scripts/setup.js"
}
}
A snippet like this is not bad by itself. Many legitimate packages build native code or download a binary. The question is whether it matches what the package claims to do.
Where the control belongs
The npm page advises authors to avoid install and preinstall unless compiling on the target architecture, and to prefer a gyp file or the prepare script. From the consumer side, your options are to review scripts for new packages, run installs for untrusted code in an isolated environment, and keep CI credentials out of the install step. The npm scripts page does not describe a flag to skip scripts, so check the current documentation for the install command itself before relying on one.
Separating the install job from the job that holds publishing or deployment secrets limits what a hostile script can reach.
Try it yourself
Open the dependency inventory demo and expand a package to see how a direct dependency pulls in others. Every one of those can carry scripts.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard's dependency scanning and SBOM generation give you the full tree to review, and the free scan at gold.safeguard.sh/scan is a quick start.
Quick check
Does npm ci run install scripts?
Yes. The npm documentation says npm ci runs the same install lifecycle scripts after modules are installed.
Is a postinstall script always malicious?
No. Many packages use it for builds. Review whether it matches the package's purpose.
Sources
Last reviewed: 19 October 2026.
