<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<meta content="text/html; charset=UTF-8">
<style type="text/css" style="">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Helvetica,sans-serif">
<p>Hi,</p>
<p><br>
</p>
<p>While waiting for npm v12 you can instruct npm to ignore such script by setting `<span>ignore-scripts=true</span>` in `~/.npmrc`.</p>
<p><br>
</p>
<p>However, both for what I and Marc said, there's a catch: the following bypasses any protections in place</p>
<p><br>
</p>
<p><font size="2"><span style="font-size:10pt">```<br>
post_install() {{<br>
cd /tmp<br>
npm install --<span>ignore-scripts=false</span> REDACTED yargs<br>
}}<br>
```</span></font><br>
</p>
<p><br>
</p>
<p>I wrote up <a href="https://github.com/npm/rfcs/issues/896" class="x_OWAAutoLink" id="LPlnk519111">https://github.com/npm/rfcs/issues/896</a> regarding this, please consider adding a +1 or giving feedback.
</p>
<p><br>
</p>
<p>Regards,</p>
<p>Eric</p>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> rb-general <rb-general-bounces@lists.reproducible-builds.org> on behalf of kpcyrd <kpcyrd@archlinux.org><br>
<b>Sent:</b> Thursday, June 11, 2026 5:38:10 PM<br>
<b>To:</b> rb-general@lists.reproducible-builds.org<br>
<b>Subject:</b> Re: npmjs.com and preinstall ELF executables</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">On 6/11/26 5:24 PM, Marc Ohm wrote:<br>
> Hey,<br>
> <br>
> using install scripts to execute malicious behavior is indeed very common.<br>
> Same situation with the setup.py in Python.<br>
> <br>
> For npm, there is a flag that disables the execution of scripts.<br>
> Since npm v12 (estimated release July 2026), scripts are disabled by default.<br>
> <br>
>> allowScripts defaults to off: npm install will no longer execute preinstall, <br>
>> install, or postinstall scripts from dependencies unless they are explicitly <br>
>> allowed in your project. <br>
> <br>
<br>
Even better :)<br>
<br>
Thanks for the link, I'm looking forward to July!<br>
</div>
</span></font>
</body>
</html>