Does npm run build also run prebuild and postbuild scripts?

Yes. When you run npm run build, npm also runs a script named prebuild before it and postbuild after it, if they exist. The npm docs say pre and post commands with matching names run for any script. A build command can therefore execute more than you see in the terminal.

The rule from the docs

The npm scripts documentation states that you create a pre or post script for any script by defining another script with a matching name and the prefix. For example, precompress runs before compress and postcompress runs after it. The same table shows that npm test runs pretest, test and posttest, npm start runs prestart, start and poststart, and npm run for a user defined name runs pre, the script, then post.

This is a feature. It is also a place for commands to hide, because a reviewer who reads only the build line misses what surrounds it.

What to look for in package.json

{
  "scripts": {
    "prebuild": "node scripts/fetch-config.js",
    "build": "vite build",
    "postbuild": "node scripts/upload-sourcemaps.js"
  }
}

In this example the visible build command is harmless. The pre script fetches something over the network and the post script ships files elsewhere. Each runs with your environment variables and tokens.

A short audit

1. Open package.json in every workspace package, not just the root.
2. List each script, and for every name check whether a pre or post twin exists.
3. Read what each twin runs. Note any network calls, file uploads or use of credentials.
4. Look at what the scripts call. A script that runs a file in your repo is reviewable. A script that runs a binary from a dependency is trusting that dependency.
5. Decide what belongs. Remove scripts that no longer do anything.
6. Run the build in a job that has no more secrets than it needs.

Table of common pairs

The install row comes from the lifecycle operation order table in the same documentation. It is a reminder that install time scripts and run time scripts are separate families.

Why dependencies matter here

These pre and post hooks come from your own package.json. Dependencies have their own scripts, which npm runs at install, covered in which npm lifecycle scripts run when you install and do npm install scripts run for dependencies. Do not mix the two. Turning off dependency install scripts does not turn off your own prebuild.

Pull requests that change the scripts section of package.json should get the same review as a change to deployment configuration. A new postbuild line is a new thing that runs in CI.

Safeguard's policies and gates can hold a pull request on dependency findings, and its SBOM and dependency scanning show what your build tooling pulls in. Try a free scan at gold.safeguard.sh/scan.

Quick check

Sources

• npm Docs: scripts

Last reviewed: 19 October 2026.