If you’re a JS dev, here’s one simple change to improve your security: disable postinstall scripts in your npm package manager.
postinstall is the main vector for supply chain attacks from node_modules, but most packages don’t need it.
↓ Thread
postinstall is the main vector for supply chain attacks from node_modules, but most packages don’t need it.
↓ Thread
December 17, 2025 at 4:08 PM
If you’re a JS dev, here’s one simple change to improve your security: disable postinstall scripts in your npm package manager.
postinstall is the main vector for supply chain attacks from node_modules, but most packages don’t need it.
↓ Thread
postinstall is the main vector for supply chain attacks from node_modules, but most packages don’t need it.
↓ Thread
🚀 Wow, this is finally happening!
npm plans to block postinstall scripts by default in a future release
In the near future (phased rollout), we will likely get a warning
github.com/npm/cli/pull...
npm plans to block postinstall scripts by default in a future release
In the near future (phased rollout), we will likely get a warning
github.com/npm/cli/pull...
May 25, 2026 at 1:40 PM
🚀 Wow, this is finally happening!
npm plans to block postinstall scripts by default in a future release
In the near future (phased rollout), we will likely get a warning
github.com/npm/cli/pull...
npm plans to block postinstall scripts by default in a future release
In the near future (phased rollout), we will likely get a warning
github.com/npm/cli/pull...
pnpm 10 will no longer run postinstall scripts by default. I think this makes us all a little bit safer.
In order to be a good citizen and help move away from postinstall scripts, the latest version of SvelteKit no longer has one. Please add "prepare": "svelte-kit sync" to your package.json instead
In order to be a good citizen and help move away from postinstall scripts, the latest version of SvelteKit no longer has one. Please add "prepare": "svelte-kit sync" to your package.json instead
pnpm can block lifecycle scripts of dependencies during installation. This is an opt-in feature though. Should we block them by default?
github.com/orgs/pnpm/di...
github.com/orgs/pnpm/di...
Should we block lifecycle script of dependencies during installation? · pnpm · Discussion #8918
There was recently an incident with rspack, where it was published with a postinstall script that contained malware. Such incidents happen from time to time, so it could be a good idea to stop runn...
github.com
January 23, 2025 at 3:44 AM
pnpm 10 will no longer run postinstall scripts by default. I think this makes us all a little bit safer.
In order to be a good citizen and help move away from postinstall scripts, the latest version of SvelteKit no longer has one. Please add "prepare": "svelte-kit sync" to your package.json instead
In order to be a good citizen and help move away from postinstall scripts, the latest version of SvelteKit no longer has one. Please add "prepare": "svelte-kit sync" to your package.json instead
i feel like deno has it very right by basically never doing a postinstall script for a package
May 12, 2026 at 4:28 AM
i feel like deno has it very right by basically never doing a postinstall script for a package
JS devs - Time to celebrate 🎊 🥂
All modern package managers will block postinstall scripts by default :
📦 npm v12 🆕
📦 pnpm 10
📦 Yarn 4.14
📦 Bun
📦 Deno
📦 Aube
This doesn't solve everything, but should greatly reduce the ability for supply chain worms to spread
github.blog/changelog/20...
All modern package managers will block postinstall scripts by default :
📦 npm v12 🆕
📦 pnpm 10
📦 Yarn 4.14
📦 Bun
📦 Deno
📦 Aube
This doesn't solve everything, but should greatly reduce the ability for supply chain worms to spread
github.blog/changelog/20...
June 10, 2026 at 7:53 AM
JS devs - Time to celebrate 🎊 🥂
All modern package managers will block postinstall scripts by default :
📦 npm v12 🆕
📦 pnpm 10
📦 Yarn 4.14
📦 Bun
📦 Deno
📦 Aube
This doesn't solve everything, but should greatly reduce the ability for supply chain worms to spread
github.blog/changelog/20...
All modern package managers will block postinstall scripts by default :
📦 npm v12 🆕
📦 pnpm 10
📦 Yarn 4.14
📦 Bun
📦 Deno
📦 Aube
This doesn't solve everything, but should greatly reduce the ability for supply chain worms to spread
github.blog/changelog/20...
sorry but bun doesn't get to claim that it's "secure" just because it blocks every package except the top 500 packages from running its postinstall script, that's just scummy advertising at best
January 14, 2025 at 1:25 PM
sorry but bun doesn't get to claim that it's "secure" just because it blocks every package except the top 500 packages from running its postinstall script, that's just scummy advertising at best
📦 sharp 0.35 - No more postinstall script
FYI, the image manipulation library now ships prebuilt versions for most platforms
You can upgrade and remove sharp from your package manager build exclusions (pnpm allowBuilds for ex)
FYI, the image manipulation library now ships prebuilt versions for most platforms
You can upgrade and remove sharp from your package manager build exclusions (pnpm allowBuilds for ex)
June 19, 2026 at 12:56 PM
📦 sharp 0.35 - No more postinstall script
FYI, the image manipulation library now ships prebuilt versions for most platforms
You can upgrade and remove sharp from your package manager build exclusions (pnpm allowBuilds for ex)
FYI, the image manipulation library now ships prebuilt versions for most platforms
You can upgrade and remove sharp from your package manager build exclusions (pnpm allowBuilds for ex)
Socket found a malicious postinstall hook across 700+ GitHub repos, including #PHP packages on Packagist and #Nodejs project repos.
The campaign involved malicious commits to affected repositories and reused the same GitHub-hosted payload infrastructure.
socket.dev/blog/malicio...
The campaign involved malicious commits to affected repositories and reused the same GitHub-hosted payload infrastructure.
socket.dev/blog/malicio...
Malicious Postinstall Hook Found Across 700+ GitHub Reposito...
Socket found a malicious postinstall hook across 700+ GitHub repos, including PHP packages on Packagist and Node.js project repositories.
socket.dev
May 22, 2026 at 9:22 PM
Socket found a malicious postinstall hook across 700+ GitHub repos, including #PHP packages on Packagist and #Nodejs project repos.
The campaign involved malicious commits to affected repositories and reused the same GitHub-hosted payload infrastructure.
socket.dev/blog/malicio...
The campaign involved malicious commits to affected repositories and reused the same GitHub-hosted payload infrastructure.
socket.dev/blog/malicio...
Agent skills are the new postinstall scripts... #changemymind
February 4, 2026 at 12:26 AM
Agent skills are the new postinstall scripts... #changemymind
GitHub's response to npm supply chain attacks is too one-sided. By reinforcing maintainer responsibility, they're missing ingestion-point detection. For example, the registry could require packages that add a postinstall script for the first time to have a semver major bump.
October 7, 2025 at 3:03 PM
GitHub's response to npm supply chain attacks is too one-sided. By reinforcing maintainer responsibility, they're missing ingestion-point detection. For example, the registry could require packages that add a postinstall script for the first time to have a semver major bump.
Should pnpm v10 throw an error if there are unreviewed packages with postinstall scripts?
Github poll: github.com/orgs/pnpm/di...
Github poll: github.com/orgs/pnpm/di...
Should pnpm v10 throw an error if there are unreviewed packages with postinstall scripts? · pnpm · Discussion #9070
Related issue. Seems like many of our users upgrade to pnpm v10 without reading through the breaking changes, and they don't notice pnpm's message about blocking installed scripts. As a result, the...
github.com
February 9, 2025 at 9:28 PM
Should pnpm v10 throw an error if there are unreviewed packages with postinstall scripts?
Github poll: github.com/orgs/pnpm/di...
Github poll: github.com/orgs/pnpm/di...
People sure do hate postInstall scripts.
July 15, 2025 at 11:46 PM
People sure do hate postInstall scripts.
It's both GitHub and npm. If it were just GitHub, it'd be happening to other package managers. Postinstall scripts were a mistake
I saw a few hot takes in response to the TanStack package attack that were a bit “hurr jabbascript bad”.
The real story here is that GitHub Actions has insufficient protections, and this attack should not have been possible.
Private CI runners and trusted publishing protect against this attack.
The real story here is that GitHub Actions has insufficient protections, and this attack should not have been possible.
Private CI runners and trusted publishing protect against this attack.
We at TanStack just had a major attack against our Router packages.
We have a postmortem out now explaining what happened and how we mitigated the response:
tanstack.com/blog/npm-sup...
No other TanStack packages outside of the Router monorepo were impacted
We have a postmortem out now explaining what happened and how we mitigated the response:
tanstack.com/blog/npm-sup...
No other TanStack packages outside of the Router monorepo were impacted
May 13, 2026 at 12:38 AM
It's both GitHub and npm. If it were just GitHub, it'd be happening to other package managers. Postinstall scripts were a mistake
warning: cypress’ postinstall cost you irreplaceable angelic pussy
June 10, 2025 at 10:19 AM
warning: cypress’ postinstall cost you irreplaceable angelic pussy
Extracting the internals of a Debian package and reading postinstall scripts to debug an issue today was not on my bingo card.
February 26, 2025 at 8:22 PM
Extracting the internals of a Debian package and reading postinstall scripts to debug an issue today was not on my bingo card.
I don't see any mention of postinstall handling
Big oof
Big oof
We're taking action to make the npm supply chain stronger and harder to attack. 🛡️
Check out our plan to create a more secure future for the JavaScript community.👇
https://github.blog/security/supply-chain-security/our-plan-for-a-more-secure-npm-supply-chain/
Check out our plan to create a more secure future for the JavaScript community.👇
https://github.blog/security/supply-chain-security/our-plan-for-a-more-secure-npm-supply-chain/
Our plan for a more secure npm supply chain
GitHub is strengthening npm's security with stricter authentication, granular tokens, and enhanced trusted publishing.
github.blog
September 30, 2025 at 8:17 PM
I don't see any mention of postinstall handling
Big oof
Big oof
All affected packages and versions are:
- eslint-config-prettier
- 8.10.1
- 9.1.1
- 10.1.6
- 10.1.7
- eslint-plugin-prettier:
- 4.2.2
- 4.2.3
- snyckit:
- 0.11.9
- @pkgr/core:
- 0.2.8
- napi-postinstall:
- 0.3.1
Thanks all, and sorry for my negligence.
- eslint-config-prettier
- 8.10.1
- 9.1.1
- 10.1.6
- 10.1.7
- eslint-plugin-prettier:
- 4.2.2
- 4.2.3
- snyckit:
- 0.11.9
- @pkgr/core:
- 0.2.8
- napi-postinstall:
- 0.3.1
Thanks all, and sorry for my negligence.
July 18, 2025 at 8:01 PM
All affected packages and versions are:
- eslint-config-prettier
- 8.10.1
- 9.1.1
- 10.1.6
- 10.1.7
- eslint-plugin-prettier:
- 4.2.2
- 4.2.3
- snyckit:
- 0.11.9
- @pkgr/core:
- 0.2.8
- napi-postinstall:
- 0.3.1
Thanks all, and sorry for my negligence.
- eslint-config-prettier
- 8.10.1
- 9.1.1
- 10.1.6
- 10.1.7
- eslint-plugin-prettier:
- 4.2.2
- 4.2.3
- snyckit:
- 0.11.9
- @pkgr/core:
- 0.2.8
- napi-postinstall:
- 0.3.1
Thanks all, and sorry for my negligence.
pnpm is the best package manager for protection against supply chain attacks (and it has the best DX overall).
They disabled postinstall a long time ago, the main attack vector.
Now they’ve added the minimumReleaseAge option to ignore new versions for, say, a day.
They disabled postinstall a long time ago, the main attack vector.
Now they’ve added the minimumReleaseAge option to ignore new versions for, say, a day.
September 15, 2025 at 7:01 PM
pnpm is the best package manager for protection against supply chain attacks (and it has the best DX overall).
They disabled postinstall a long time ago, the main attack vector.
Now they’ve added the minimumReleaseAge option to ignore new versions for, say, a day.
They disabled postinstall a long time ago, the main attack vector.
Now they’ve added the minimumReleaseAge option to ignore new versions for, say, a day.
1. For npm:
echo "ignore-scripts=true" >> .npmrc
For yarn berry:
echo "enableScripts: false" >> .yarnrc.yml
pnpm and bun are already safe, postinstall is disabled by default (another reason to migrate).
echo "ignore-scripts=true" >> .npmrc
For yarn berry:
echo "enableScripts: false" >> .yarnrc.yml
pnpm and bun are already safe, postinstall is disabled by default (another reason to migrate).
December 17, 2025 at 4:08 PM
1. For npm:
echo "ignore-scripts=true" >> .npmrc
For yarn berry:
echo "enableScripts: false" >> .yarnrc.yml
pnpm and bun are already safe, postinstall is disabled by default (another reason to migrate).
echo "ignore-scripts=true" >> .npmrc
For yarn berry:
echo "enableScripts: false" >> .yarnrc.yml
pnpm and bun are already safe, postinstall is disabled by default (another reason to migrate).
Disabling postinstall scripts, requiring minimum age of packages (pnpm feature).
March 31, 2026 at 7:47 AM
Disabling postinstall scripts, requiring minimum age of packages (pnpm feature).
Tfw when you make a galaxy brain chess move but then trip over your shoelaces
May 20, 2026 at 1:50 AM
Tfw when you make a galaxy brain chess move but then trip over your shoelaces
Let me guess, it's the pre- or postinstall script again
November 25, 2025 at 11:31 AM
Let me guess, it's the pre- or postinstall script again