npm –ignore-scripts, yarn –version

npm pack --ignore-scripts runs prepare Running npm pack --dry-run --ignore-scripts is (apparently?) supposed to be benign. This surprised me: $ npm pack --dry-run --ignore-scripts anythingatall@someone/somerepo > gitdep@1.0.0 prepare > node -e "require('fs').writeFileSync('/tmp/test','PREPARE RAN')" [...] $ cat /tmp/test PREPARE RAN The name before the @ doesn’t matter. npm will automatically download https://github.com/someone/somerepo, treat it as an npm package’s source, and execute its prepare script. npm pack <package> is (apparently?) the usual way to look at an npm package’s code without installing it, and for a package from the registry, that’s fine: it’s already built, so npm just downloads the tarball and nothing runs (with or without --ignore-scripts btw.) But… a git repository isn’t built yet, so npm builds it first, and building it is what prepare is for (same goes for packing a local folder). It isn’t only npm pack, either: on npm 10, npm install --ignore-scripts with a…