From 98b8fb655d4c23b5c65e3c53bfe51c110c607ba7 Mon Sep 17 00:00:00 2001 From: Bryan Helmkamp Date: Wed, 26 Nov 2025 10:36:18 -0500 Subject: [PATCH] ci: add --ignore-scripts to npm install for security MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This prevents npm from executing any lifecycle scripts (including postinstall) during dependency installation, reducing the attack surface from malicious packages. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- .github/workflows/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 91f1ffb..8cc3ef1 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -29,7 +29,7 @@ jobs: node-version: ${{ matrix.node }} - name: Install dependencies - run: npm install + run: npm install --ignore-scripts - name: Run tests run: npm test