Often yes, with an allow plan for packages that need install scripts. Setting ignore-scripts to true makes npm skip the scripts defined in package.json files, including install hooks that malicious packages abuse. It breaks packages that compile native code or download binaries during install, so test before you switch.
What the setting does
The npm documentation says that when ignore-scripts is true, npm does not run scripts specified in package.json files. The default is false. Commands that exist to run a particular script, such as npm test, npm start and npm run-script, still run their intended script, but they do not run any pre or post scripts.
Why it matters in CI
A CI runner usually holds credentials: a registry token, cloud access, a deploy key. If a dependency, or a dependency of a dependency, runs code at install time, that code runs with those credentials in reach. Disabling install scripts removes that route for many package compromises, though not for code that runs when your app or tests import the package.
How to switch it on
You can pass the flag on the command line, or set it in project configuration.
npm ci --ignore-scripts
Then run your own build and test scripts explicitly, as separate steps.
What breaks
| Package behavior | With ignore-scripts |
|---|---|
| Pure JavaScript, no install hook | Works |
| Native addon compiled at install | Fails or is unusable until you rebuild it explicitly |
| Downloads a binary at install | Binary is missing |
| Your own postinstall build | Does not run, call it yourself |
A workable plan
- Run the install with ignore-scripts in CI.
- List which dependencies fail and why.
- For each, decide: rebuild it explicitly in a later step you control, replace it, or accept the script after reading it.
- Keep the credentialed steps, such as publish and deploy, in separate jobs that never run an install of untrusted code.
- Inventory your dependencies so you know which ones have install hooks.
This is one layer. It does not stop a malicious package from running when your tests load it, which is why scanning and lockfile review still matter.
Try it yourself
Click through it at your own pace, or open it full screen. Look at direct versus transitive dependencies, since most install hooks come from the transitive ones.
Quick check
Does ignore-scripts stop all malicious packages?
No. It stops install-time scripts. Code that runs when the package is imported still runs.
Will npm test still work?
Yes. npm documents that it still runs its intended script, but not pre or post scripts.
Safeguard scans dependencies and generates SBOMs, and policies and gates can fail a pull request on findings. The free scan is a quick check.
Sources
Last reviewed: 19 October 2026.
