How to have `ignore-scripts=true` but still have `prepare` script run in own package on publish?

[sindresorhus]

I want to have ignore-scripts=true in my global .npmrc for security reasons, but I still need to publish packages that need to build TypeScript code on publish. This worked until v11, which includes:

--ignore-scripts now applies to all lifecycle scripts, include prepare

However, I still need the local prepare script to run on publish. Otherwise, there is no way to have TypeScript code built automatically when running npm publish, unless I'm missing something?

I understand to desire to have ignore-scripts=true apply to everything, but there needs to be a solution for publishing packages.

[nikunj-kohli]

I would like to contribute here, I request you to assign me

[Standard8]

This was introduced by #7800.

We are considering using the ignore-scripts=true on our repositories to help improve security (e.g. against post-installs scripts being injected), but like the reporter, we have prepack/prepublish scripts that need to run for some cases, so globally turning off scripts breaks those workflows.

I think the ideal solution would be that ignore-scripts was a tri-state all, install or off (or something like that), however, that would be a breaking change, though maybe we could also allow true and false boolean values (not sure how the code works).

The alternative would be some kind of second variable e.g. allow-publish-and-pack-scripts to allow those scripts when we need them.

@wraithgar apologies for the tag, but I see you reviewed the original issue. What would be the way forward here? Does this need an RFC?

I'm not sure I'd have time to work on it, but I'm hoping to at least get the discussion started.

[jorenbroekema]

This would be quite helpful for us as well.

As far as I understand (and please correct me if I'm wrong), the primary vector of attack of supply chain attacks via npm scripts hooks, are via npm install or similar like npm ci, because it fires the following hooks (from the docs https://docs.npmjs.com/cli/v8/using-npm/scripts#life-cycle-operation-order):

• preinstall
• postinstall
• prepublish
• preprepare
• prepare
• postprepare

not just from your package.json but also the pre/post scripts in the package.json's of all of the installed dependencies, allowing the execution of potentially malicious third-party scripts. Or is that only true for postinstall?

That said, it seems like pre/post hooks for other npm lifecycle hooks don't suffer from that same vulnerability (again, correct me if I'm wrong here), and should still be allowed? As a platform engineer in our company, forcing ignore-scripts=true in all CI/CD pipelines would be quite harsh on all of the projects that make use of such hooks, e.g. prepublishOnly being quite common.

Edit: would also be fine if there was a --ignore-dependencies-scripts, allowing self and workspace-self scripts to still run, but not those of dependencies.

[wraithgar]

This is the very problem we are discussing in npm/rfcs#861