News for hackers. Stuff that matters.

A comment on Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan. Parent comment

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by xenophonf on Tuesday March 31, 2026 @08:22AM (#47586283)
Where in the pnpm documentation does it say that it ignores scripts by default?

From https://pnpm.io/cli/install#--ignore-scripts:

> Default: *false*

[ Parent | on HN ]
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by moebrowne on Tuesday March 31, 2026 @12:09PM (#47589536)
Weird. The config also appears to default to `false`

https://pnpm.io/settings#ignorescripts

[ Parent | on HN ]
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by simonkagedal on Tuesday March 31, 2026 @03:28PM (#47592248)
This page describes the behavior, "disables the automatic execution of postinstall scripts in dependencies":

https://pnpm.io/supply-chain-security

While this explicitly calls out "postinstall", I'm pretty sure it affects other such lifecycle scripts like preinstall in dependencies.

The --ignore-scripts option will ignore lifecycle scripts in the project itself, not just dependencies. And it will ignore scripts that you have previously allowed (using the "allowBuilds" feature).

[ Parent | on HN ]