ignore-scripts=true is a control, not a preference

Every repository we ship has this in .npmrc:

ignore-scripts=true

It is three words and it is one of the few settings we treat as non-negotiable.

The argument

An install script executes on your machine, and in your CI, and in your build image, before anyone has read a line of the package. The review you were planning to do happens after the code has already run.

That is not a hypothetical. It is the delivery mechanism for most of the notable npm supply-chain incidents of the last several years: the malicious code is in postinstall, and it runs during npm install, and by the time anyone looks at the diff it has already read your environment.

The objection

“But some packages need it.”

Fewer than you think. sharp is the usual example, and it has shipped prebuilt binaries as optional dependencies since 0.33 — no script required. Most of the remainder are build-tool conveniences that you can invoke explicitly.

When something genuinely needs a script, run it explicitly and knowingly:

pnpm rebuild <package>

That is a decision with a name on it, which is the difference.

The cost

Occasionally a dependency does not work and you spend twenty minutes finding out that it wanted a script. That has happened to us twice.

Weighed against arbitrary code execution in CI, twenty minutes twice is not a close call.