Set ignore-scripts=true in .npmrc to stop npm running lifecycle scripts. pnpm and Bun already block most dependency scripts until you approve them. Modern Yarn has an enableScripts setting. Then allow only the few packages that truly need a build step, by name.
The settings, side by side
| Tool | How to switch scripts off | How to allow an exception |
|---|---|---|
| npm | ignore-scripts=true in .npmrc | Run the needed package's script by hand, or turn the setting off for one command |
| pnpm | Dependency build scripts need approval; ignoreScripts turns all off | Approve by package name in your pnpm build settings |
| Yarn (modern) | enableScripts: false in .yarnrc.yml | Per package setting in dependenciesMeta |
| Bun | Dependency scripts only run for trusted packages; ignore-scripts turns all off | Add the package to trustedDependencies |
npm
The npm documentation defines ignore-scripts as: if true, npm does not run scripts specified in package.json files. The default is false. Explicit commands such as npm test and npm run-script still run their named script.
# .npmrc in the project root
ignore-scripts=true
Commit this file so CI and every developer get the same behavior.
pnpm
pnpm does not run dependency build scripts without approval. Its settings reference says strictDepBuilds defaults to true and makes the install exit non-zero when a dependency has build scripts nobody has reviewed. The dangerouslyAllowAllBuilds setting removes the approval step, including for future and transitive dependencies, so avoid it.
The approval list setting changed names between major versions: the page says onlyBuiltDependencies was removed in pnpm 11 and replaced by allowBuilds. Check which version you run before copying an old snippet.
Yarn
The modern Yarn configuration page documents enableScripts as the switch for whether postinstall scripts run for third-party packages. Setting it to false stops them.
# .yarnrc.yml
enableScripts: false
Bun
Bun's lifecycle documentation says it does not run arbitrary lifecycle scripts by default. It runs them only for packages on a built-in trusted list or in your trustedDependencies. Note that defining your own list replaces the default list, and an empty list trusts nobody.
Enforce it in CI
A setting on a laptop is a habit. A check in the pull request is a control. Fail the build when the config file loses the setting.
Click through it at your own pace, or open it full screen.
Quick check
Will turning off scripts break my build?
It can, for packages that compile native code or fetch a binary at install. Allow those by name and leave the rest off. Test once in a clean checkout.
Is ignoring scripts enough to be safe?
No. A package can still run code when your app imports it. Scripts off removes one automatic path. See why ignore-scripts is not enough.
Safeguard policies and gates can block a pull request that changes your dependencies, and you can run a free scan to see what your tree contains today.
Sources
Last reviewed: 19 October 2026.
