Set ignore-scripts true by default

[chuacw]

Attackers have become more sophisticated and the entire npm ecosystem is under attack by malicious actors.
Some of these attackers use part of the npm infrastructure to attack users by running scripts after installation of their npm packages.

I suggest that npm set ignore-scripts to true by default, so that after a package installation, scripts are no longer automatically run by default.

Please consider this.

[kchindam-infy]

This is a feature request/discussion rather than a CLI bug. we are going to close it here and recommended moving the conversation to our https://github.com/npm/feedback/discussions

[owlstronaut]

https://github.com/orgs/community/discussions/174507 is where the discussion around the changes in response to Shai-Hulud are being discussed now.

[Jokero]

@owlstronaut No single word about ignore-scripts in this discussion

[bburns]

I realize it's a matter of convenience over security, but maybe worth revisiting, in light of the axios supply chain attack -

"Its sole purpose is to execute a postinstall script that acts as a cross-platform remote access trojan (RAT) dropper, targeting macOS, Windows, and Linux"

https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html

---

And as @Jokero mentioned, that discussion thread and blog post (about GitHub's supply chain security) barely mentions lifecycle or postinstall scripts.

For further reference/discussion, pnpm disabled lifecycle scripts here -

By default no dependency is allowed to run lifecycle scripts during installation.

pnpm/pnpm#8897