Modern Yarn does not run postinstall scripts from third-party packages by default, because the enableScripts setting defaults to false. You can allow specific packages through dependenciesMeta, and hardened mode adds checks for malicious lockfile changes, turned on automatically for pull requests from public repositories on GitHub.
What the configuration says
The Yarn configuration reference describes enableScripts as the setting that defines whether to run postinstall scripts. If false, which is the default, Yarn will not execute postinstall scripts from third-party packages.
The manifest reference adds the per-package control. In dependenciesMeta, a package with built set to false never runs its build script, which acts as a deny-list entry. If enableScripts is off, the behavior flips to an allow-list: only packages with built set to true are built. Warnings for denied packages are downgraded to simple notices.
Check which Yarn version your project runs, since this describes the current documentation and older Yarn releases behave differently.
Hardened mode and immutable installs
Two more settings help in CI:
| Setting | What the docs say |
|---|---|
| enableImmutableInstalls | Defines whether adding or removing lockfile entries is allowed. True by default on CI. |
| enableHardenedMode | Defines whether Yarn tries to check for malicious changes. Enabled automatically on GitHub pull requests from public repositories. |
| checksumBehavior | Defaults to throw when a checksum does not match. |
Together they mean an outside contributor's pull request cannot quietly rewrite the lockfile or swap a package archive without Yarn complaining.
What to review anyway
Default-off scripts reduce risk, but they do not remove it. Packages still run at runtime, and a package you explicitly allow to build runs its script with your permissions.
- List packages you have allowed with built set to true and note why.
- Keep allow entries in version control so changes show in review.
- Make sure CI uses immutable installs.
- Treat a changed checksum as an incident until explained, not a nuisance to reset.
- Re-check allowed packages when they publish a new major version.
Common mistakes
A frequent one is turning enableScripts on globally to fix one failing native build. That allows every package to run scripts again. Allow the single package through dependenciesMeta instead. Another is assuming a default-off setting in a new Yarn version also applies to the older Yarn used by some projects or CI images. Confirm the version in CI logs. Last, do not read hardened mode as a malware scanner. It checks for suspicious lockfile changes, and it does not judge what a package does at runtime.
Quick check
Does Yarn run postinstall scripts from dependencies?
By default in current Yarn, no. The enableScripts setting defaults to false for third-party packages.
How do I allow one package to build?
Use dependenciesMeta with built set to true for that package. If enableScripts is off, only those packages are built.
Safeguard scans your lockfile into an SBOM and applies policies to dependency changes. The free scan is at gold.safeguard.sh/scan. See also pnpm and modern Yarn lockfile security.
Sources
Last reviewed: 19 October 2026.
