An npm install script is a command listed in a package's package.json that npm runs automatically while installing it. The main ones are preinstall, install, postinstall and prepare. They execute on your machine, with your permissions, before you have run any of the package's code yourself.
Which scripts run during install
The npm documentation lists these lifecycle events under npm install: preinstall, install, postinstall, prepublish, preprepare, prepare and postprepare. They also run on a global install.
Two details catch people out:
- A package with a
binding.gypfile and no custom install or preinstall script gets an implicit install step. npm defaults it to a node-gyp rebuild. - The
preparescript also runs on a plainnpm installwith no arguments in a project folder.
So a package does not need to declare a script in an obvious place for something to execute at install time.
Why this matters for malicious packages
Install scripts exist for good reasons. Native add-ons need compiling, and some tools download a platform binary. The same mechanism lets a hostile package run code the moment it lands in node_modules, with no import and no test run needed.
That is why install scripts show up so often in malicious package write-ups. The script runs as the user doing the install, which on a developer laptop can mean access to source, tokens and SSH keys, and in CI can mean access to pipeline secrets.
Install scripts are not the only route. Code can also run when a package is imported. Our post on import-time malware covers why switching scripts off is a step, not a finish line.
How to see what a package will run
Before installing, ask the registry. This prints the scripts block for the latest version without installing anything:
npm view some-package scripts
After installing, search your tree for packages that define install-time hooks:
grep -l -E '"(preinstall|install|postinstall)"' node_modules/*/package.json
A short list is normal. Look at each entry: does a package that is meant to format dates really need a postinstall step?
What to do with the answer
Decide per package. Packages that legitimately need a build step can be allowed by name. Everything else can run with scripts off. The next post in this series, how to disable install scripts in npm, pnpm, Yarn and Bun, shows the settings.
Quick check
Do install scripts run for transitive dependencies?
Yes. Scripts defined by any package being installed can run, not only the packages you listed in your own package.json. That is why a single added dependency can bring in several scripts.
Does npm run install scripts during npm ci?
The npm documentation for npm ci does not describe a script difference from npm install, so assume they run unless you disable them with the ignore-scripts setting.
If you want a view of what is in your dependency tree, run a free scan. Safeguard does SBOM and dependency scanning so you can see every package, direct and transitive, in one list.
Sources
Last reviewed: 19 October 2026.
