Skip to content

added --ignore-scripts for all npm/yarn installs#107

Open
jkosanam wants to merge 1 commit intomasterfrom
npm-update
Open

added --ignore-scripts for all npm/yarn installs#107
jkosanam wants to merge 1 commit intomasterfrom
npm-update

Conversation

@jkosanam
Copy link
Copy Markdown
Collaborator

@jkosanam jkosanam commented Nov 26, 2025

A widespread ongoing NPM supply-chain attack is exploiting the preinstall lifecycle phase to execute malicious code during package installation. Disabling lifecycle scripts prevents any untrusted or compromised packages from executing arbitrary code during npm install / yarn install.

These scripts can:

  1. Execute harmful code on your machine or CI/CD servers
  2. Create unauthorized GitHub workflow files (.github/workflows/discussion.yaml)
  3. Potentially steal tokens, modify repos, inject malware, etc.

Made changes to use npm install --ignore-scripts instead of regular installs.
This prevents execution of preinstall/postinstall lifecycle scripts as part of the ongoing NPM supply-chain security incident.

https://do-internal.atlassian.net/browse/SERVERLESS-3668

Copy link
Copy Markdown

@sanpj2292 sanpj2292 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[Q] Is the build happening correctly if we skip these scripts ?

@jkosanam
Copy link
Copy Markdown
Collaborator Author

jkosanam commented Dec 8, 2025

[Q] Is the build happening correctly if we skip these scripts ?

Yes, build is successful and all the tests were passed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants