Setting ignore-scripts to true stops npm from running lifecycle scripts in package.json files during install. That removes a common way for a bad package to run code on your laptop. It also breaks packages that need a build step, and it does not stop code that runs when you import the package.
What the setting does
The npm documentation says ignore-scripts controls whether npm runs the scripts defined in package.json files. The default is false, so scripts run. When true, npm does not run them.
There is an exception. Commands meant to run a specific script, such as npm start, npm stop, npm restart, npm test and npm run-script, still run their target script. They skip any pre and post scripts.
Why developers care
Install scripts run with your user's rights, on your machine, as soon as you install. If your home directory holds SSH keys, cloud credentials and tokens, a script in a dependency can read them. Turning scripts off closes that particular door.
It is one door. A malicious package can also run code when you import it or when your build calls it. See the related post on why ignore-scripts alone is not enough for import-time malware.
What breaks
Some packages use install scripts for legitimate work, such as compiling native code or downloading a prebuilt binary. With scripts off, those packages may install but not work. The npm page does not list which ones, so test your own project.
Three ways to apply it
- Per command: add the flag to a single install when you are trying something unfamiliar.
- Per project: put the setting in the project's npm configuration, so teammates and CI behave the same.
- Globally: set it in your user configuration, then run scripts deliberately with npm run-script or for named packages.
How to scope the setting to a project file is covered in npm's configuration docs; check the current syntax there.
A routine that works
- Install with scripts disabled.
- Run your tests. If something fails because a package needs its script, find out which one.
- Read what that script does before allowing it.
- Allow it for that case only, and write the reason in the repository.
- Keep a list of packages you allowed, and review it when they update.
Add visibility
Disabling scripts reduces what runs. It does not tell you which packages are in your tree or which have known vulnerabilities. An inventory of dependencies does, and you can see how that looks in the demo.
Click through it at your own pace, or open it full screen.
Quick check
Does ignore-scripts stop npm test from running?
No. npm says commands such as npm test and npm run-script still run their target script, but they skip pre and post scripts.
Is the default on or off?
The default is false, so lifecycle scripts run unless you change it.
Sources
Last reviewed: 19 October 2026.
