npm pack --ignore-scripts, .npm-extension

In my last post, I remarked that “it’s not obvious to me that --ignore-scripts really makes npm pack completely benign on a local package”. The context of that was npm/cli#7211: someone wanted npm pack and npm publish to honour --ignore-scripts so that a CI publish job holding the npm token couldn’t be turned into a secret-leaking machine by anybody who can edit package.json. npm sided with that, and npm 11 made prepare respect the flag (prepack and postpack already did). So, I wondered if that really achieved it. As it turns out, perhaps unsurprisingly, it still runs code, just not calling it a “script” anymore. npm extensions What does npm pack actually do? It’s a short walk: npm pack, which uses libnpmpack, which uses pacote, npm’s package-fetching library. libnpmpack is where prepack/postpack live, and they’ve always been gated (if (spec.type === 'directory' && !opts.ignoreScripts)). As in the last post, --ignore-scripts skipped prepack but ran prepare anyways, since it was one…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town