How do you vet an npm package before you install it?

Before you install an npm package, check four things: whether it runs install scripts, who publishes it and whether its provenance verifies, what other packages it pulls in, and whether you need it at all. Then install with scripts off where you can, and verify signatures afterward.

Why does installing run code?

npm lifecycle scripts run during installation. The npm documentation lists the order for commands like npm install and npm ci: preinstall, install and postinstall, then prepublish and prepare steps, all running after modules are placed in node_modules. If a package or one of its dependencies declares such a script, it runs with your user's permissions on your machine or build server.

That is why the setting ignore-scripts exists. Its documented default is false, and when true npm does not run scripts specified in package.json files. Commands that explicitly run a named script, such as npm start, still do.

What can you read before installing?

Use npm view to see metadata without installing: the maintainers list, version history, dependencies, repository link and the scripts section. Compare these with expectations. A package that claims to format dates and declares a postinstall script that fetches something from the network deserves a closer look.

Check the surrounding signals too. How old is the package? Did the maintainer list change recently? Does the repository link point to a real repository that matches the published contents? Is the name one character away from a popular package? A constructed example: you want a small color helper, and the search returns two packages with near-identical names. One has one version published last week and a postinstall script. The other has years of releases and no scripts. The comparison takes two minutes and decides the question.

What does provenance tell you?

The npm docs describe provenance attestations as a way to publicly establish where a package was built and who published it, by linking the package to its source code and build instructions. You can verify them for downloaded packages with npm audit signatures. The command reports how many registry signatures and attestations verified across the project.

Registry signatures cover integrity: the docs explain they protect against an attacker controlling a registry mirror or proxy who tries to tamper with the tarball. Provenance covers origin. Neither says the code is harmless. A malicious maintainer can publish a perfectly signed, perfectly attested package. Treat verification as one signal that removes certain attacks, not a clearance.

How big is the tree you are accepting?

Installing one package can add dozens of transitive ones, each with its own maintainers and scripts. Look at the dependency list before you commit. npm audit submits the dependency description to the registry and returns known vulnerabilities with remediation, so run it as well, with the caveat that it only knows about reported issues.

Pin the result. Commit the lockfile, install with npm ci in CI, and review lockfile changes in pull requests like source changes.

What to do

1. Decide whether you can write the five lines yourself instead of adding a dependency.
2. Run npm view on the package. Read maintainers, repository, versions, dependencies and scripts.
3. Look for install scripts in the package and in its dependency list. If any exist, read them first.
4. Install in a throwaway directory or container with scripts disabled, then inspect.
5. Run npm audit signatures and npm audit and record the results.
6. Commit the lockfile and install with npm ci in CI.
7. Add automated checks. Safeguard has a Gold Open Source Chrome extension and a free in-browser scan at gold.safeguard.sh/scan (up to 100 dependencies) that can help you check packages, and its dependency scanning can enforce policy on new additions.

Quick check

Sources

1. npm Docs: Generating provenance statements
2. npm Docs: About registry signatures
3. npm Docs: npm audit
4. npm Docs: Scripts

Last reviewed: 18 October 2026.