For most developers, yes: turning on the ignore-scripts setting means npm will not run lifecycle scripts from dependencies when you install, which removes a common route for malware to execute on your laptop. The cost is that packages needing a build step may fail until you handle them deliberately.
What the setting does
npm's configuration reference says that when ignore-scripts is true, npm does not run scripts specified in package.json files. There is one nuance worth knowing. Commands explicitly meant to run a script, such as npm start, npm test and npm run-script, still run the script you asked for. They just skip the pre and post scripts around it.
So the setting changes what happens during install, not what happens when you deliberately run your own project's test script.
Why laptops are the right place for it
A dependency install script runs with your user account. That account usually holds a browser profile, cloud credentials, SSH keys and package registry tokens. The pnpm project makes the same point in its supply chain guidance: historically, most compromised packages used postinstall scripts to run code immediately upon installation.
Your laptop is also where you run installs most often and with the least review, because you are trying something out or fixing a quick bug.
How to turn it on
Set it once for your user account so it applies to every project:
npm config set ignore-scripts true
npm config get ignore-scripts
You can also keep a project level .npmrc with the same line, so teammates and CI behave the same way. If you do, say so in the README, or the first person with a native module will quietly turn it off.
What breaks, and what to do about it
Some legitimate packages compile native code or download a binary during install. With scripts disabled, those can fail or leave a half set up package. Handle it in this order:
- Find out which package failed and read what its install script does.
- Decide whether you trust that package at this exact version.
- Run the build step for that one package yourself, instead of re-enabling scripts for everything.
- Note the decision in the repository so it is repeatable.
This mirrors what pnpm 10 does by default. It disables automatic postinstall in dependencies, and recommends listing only trusted dependencies in its allowBuilds setting, so a package that never needed a build cannot suddenly run one when a compromised version appears.
Limits to be honest about
Ignoring scripts does not make a package safe. The code still lands in node_modules, and it runs when your application imports it, including in tests. Treat the setting as one layer next to lockfiles, review of new dependencies and short lived tokens. It also does not protect you from a malicious package you run with npx, since that is the point of the command.
If you want a quick look at what your projects actually resolve, Safeguard offers SBOM and dependency scanning, and there is a free scan at gold.safeguard.sh/scan.
Click through it at your own pace, or open it full screen.
Quick check
Does ignore-scripts stop npm test from running?
No. Per the npm configuration reference, commands explicitly intended to run a script, such as npm test, still run it. The pre and post scripts around it are skipped.
Should I set it globally or per project?
Both is reasonable. A user level setting protects every folder you open, and a project level .npmrc keeps teammates consistent.
Sources
Last reviewed: 19 October 2026.
