Huge News!Announcing our $40M Series B led by Abstract Ventures.Learn More
Socket
Sign inDemoInstall
Socket

no-scripts

Package Overview
Dependencies
Maintainers
1
Versions
6
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

no-scripts

A CLI tool that checks your project's npm dependencies and alerts you if any of them define one of the [npm lifecycle script](https://docs.npmjs.com/cli/v10/using-npm/scripts) that are automatically executed during `npm install`. Namely `preinstall`, `ins

  • 0.2.1
  • latest
  • Source
  • npm
  • Socket score

Version published
Maintainers
1
Created
Source

no-scripts

A CLI tool that checks your project's npm dependencies and alerts you if any of them define one of the npm lifecycle script that are automatically executed during npm install. Namely preinstall, install, postinstall, preuninstall and postuninstall.

Such scripts are typically no issue and might be required by a package to work properly. However, they can also pose a security threat as outlined here and here. The main danger being that a user is often not aware or fully in control of their execution.

This is a great tool to regularly execute in your CI so you can spot whether a dependency introduced an install script.

To further secure your system from such attacks you should consider having npm ignore all implicit scripts using the configuration command: npm config set ignore-scripts true

Also make sure to update your CI jobs to run npm ci --ignore-scripts and npm publish --ignore-scripts (as also suggested here)

Note however that this disables any pre- and post-scripts, such as for example the commonly used pretest script.

Also, in case one of your dependencies does need an install script to run, you will have to manually execute npm rebuild <package name> to run those after install or manually reset the configuration option mentioned before.

Install

npm i -g no-scripts

Usage

no-scripts

By default, no-scripts will analyze all locally installed dependencies of the project in the current working directory. For this, it evaluates the package.json file of every package, applying normalization using @npmcli/package-json in order to also detect implicit install-scripts such as node-gyp rebuild which would be executed if a package contains *.gyp files.

If any install-scripts have been found, the tool's exit code will be set to 1 and a list of the affected packages is shown.

Ignore Dependencies

no-scripts --ignore <package name> <package name> <...>

In case one of your project's dependencies requires an install script you can ignore that package from the analysis using the --ignore flag. For example no-scripts --ignore esbuild>

Online Mode

no-scripts --online

This mode operates fully online and is therefore a little slower. Instead of analyzing already installed dependencies, it starts by independently fetching the tarballs of all dependencies listed in the project's lockfile from the corresponding npm registry.

Since a malicious package that has already been installed could altered it's own package.json during the postinstall phase, this mode might add an extra level of safety, making it harder for such packages to fool no-scripts compared to the default, local scan. I have not yet evaluated the feasibility of such an attack though.

Note: Local dependencies which are referenced via links or workspaces are not analyzed in this mode. You can use the --include-local option to additionally check those.

Similar Projects

FAQs

Package last updated on 08 Jan 2024

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc