A CLI tool that checks your project's npm dependencies and alerts you if any of them define one of the [npm lifecycle script](https://docs.npmjs.com/cli/v10/using-npm/scripts) that are automatically executed during `npm install`. Namely `preinstall`, `ins
A CLI tool that checks your project's npm dependencies and alerts you if any of them define one of the npm lifecycle script that are automatically executed during npm install. Namely preinstall, install, postinstall, preuninstall and postuninstall.
Such scripts are typically no issue and might be required by a package to work properly. However, they can also pose a security threat as outlined here and here. The main danger being that a user is often not aware or fully in control of their execution.
This is a great tool to regularly execute in your CI so you can spot whether a dependency introduced an install script.
To further secure your system from such attacks you should consider having npm ignore all implicit scripts using the configuration command: npm config set ignore-scripts true
Also make sure to update your CI jobs to run npm ci --ignore-scripts and npm publish --ignore-scripts (as also suggested by snyk for example)
Note however that this disables any pre- and post-scripts, such as for example the commonly used pretest script.
Also, in case one of your dependencies does need an install script to run, you will have to manually execute npm rebuild <package name> to run those after install.
npm install --global no-scripts
no-scripts
By default, no-scripts will start by fetching the tarballs of all dependencies listed in the project's lockfile from the corresponding npm registry. It then evaluates the package.json files of every package, applying normalization using @npmcli/package-json in order to detect implicit install-scripts such as node-gyp rebuild which would be executed if a package contains *.gyp files.
If any install-scripts have been found, the tools exit code will be set to 1.
Note: Local dependencies which are referenced via links or workspaces are not analyzed. You can use the --include-local option to additionally check those.
no-scripts --ignore <package name> <package name> <...>
In case one of your project's dependencies requires an install script you can ignore that package from the analysis using the --ignore flag. For example no-scripts --ignore esbuild>
no-scripts --include-local
This mode operates fully offline and is therefore rather fast. However, since a malicious package that has already been installed could have altered it's own package.json during the postinstall phase, this mode might be fooled into thinking that a package has no scripts even though they were already executed. I have not yet evaluated the feasability of such an attack though.
no-scripts --offline
This option implies --include-local as it completely skips the default behavior of resolving the packages listed in the lockfile using a remote registry.
FAQs
A CLI tool that checks your project's npm dependencies and alerts you if any of them define one of the [npm lifecycle script](https://docs.npmjs.com/cli/v10/using-npm/scripts) that are automatically executed during `npm install`. Namely `preinstall`, `ins
The npm package no-scripts receives a total of 0 weekly downloads. As such, no-scripts popularity was classified as not popular.
We found that no-scripts demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.
Security News
Sonar’s acquisition of Tidelift highlights a growing industry shift toward sustainable open source funding, addressing maintainer burnout and critical software dependencies.