From 568a8d642ec2d6fd28c641156b8fff475f8367fa Mon Sep 17 00:00:00 2001
From: Nicolas Ayral Seydoux <nseydoux@inrupt.com>
Date: Tue, 15 Sep 2026 11:51:21 +0200
Subject: [PATCH] Disable install scripts

Install scripts are a common attack vector, and disabling them by default is good practice. Required scripts can be re-enabled on a case-by-case basis.
---
 .github/workflows/api-docs.yml    | 2 +-
 .github/workflows/ci.yml          | 2 +-
 .github/workflows/e2e-browser.yml | 2 +-
 .github/workflows/e2e-node.yml    | 2 +-
 .github/workflows/release.yml     | 1 +
 .npmrc                            | 2 ++
 package.json                      | 1 -
 7 files changed, 7 insertions(+), 5 deletions(-)
 create mode 100644 .npmrc

diff --git a/.github/workflows/api-docs.yml b/.github/workflows/api-docs.yml
index b442179588..1c77253c31 100644
--- a/.github/workflows/api-docs.yml
+++ b/.github/workflows/api-docs.yml
@@ -23,7 +23,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v7
         with:
-          node-version: "20"
+          node-version-file: ".nvmrc"
           cache: "npm"
       - name: Install dependencies
         run: npm ci
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cf85a5044e..efaf66212c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,7 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
           cache: "npm"
-      - run: npm ci --ignore-scripts
+      - run: npm ci
       # Unit tests are separate because running both at the same time causes issues
       # to the CI runner.
       - run: npm run test:unit:browser
diff --git a/.github/workflows/e2e-browser.yml b/.github/workflows/e2e-browser.yml
index e286a9e515..87086a1dbd 100644
--- a/.github/workflows/e2e-browser.yml
+++ b/.github/workflows/e2e-browser.yml
@@ -35,7 +35,7 @@ jobs:
           cache: "npm"
           cache-dependency-path: "**/package-lock.json"
       # install
-      - run: npm ci --ignore-scripts
+      - run: npm ci
       # build
       - run: npm run build
       # setup
diff --git a/.github/workflows/e2e-node.yml b/.github/workflows/e2e-node.yml
index 306be6a4a3..338d17f4e8 100644
--- a/.github/workflows/e2e-node.yml
+++ b/.github/workflows/e2e-node.yml
@@ -33,7 +33,7 @@ jobs:
       - name: Install dependencies
         # FIXME: setup-node's caching seems to not restore correctly: https://github.com/actions/setup-node/pull/323/files
         # if: steps.setup-node.outputs.cache-hit != 'true'
-        run: npm ci --ignore-scripts
+        run: npm ci
 
       - # Dependabot cannot access secrets, so it doesn't have a token to authenticate to ESS.
         # We want jobs in this workflow to be gating PRs, so the whole matrix must
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 769576a9e5..6c2005cdbe 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,5 +27,6 @@ jobs:
       - run: npm install -g npm@latest
       - run: npm --version
       - run: npm ci
+      - run: npm run build
       - run: npm stage publish
       - run: echo "The package has been staged, go to https://www.npmjs.com to publish it."
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000000..730d526135
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,2 @@
+# Prevent supply chain attacks targetting install scripts.
+ignore-scripts=true
diff --git a/package.json b/package.json
index 50e4f6c1b7..2b1755663e 100644
--- a/package.json
+++ b/package.json
@@ -18,7 +18,6 @@
     "lint:check": "npm run lint:eslint",
     "lint:eslint": "eslint --config eslint.config.mjs .",
     "list-licenses": "license-checker --production --csv --out LICENSE_DEPENDENCIES_ALL",
-    "prepublishOnly": "npm run build",
     "test": "jest --ignoreProjects e2e-node",
     "test:unit:browser": "jest --selectProjects browser-utc",
     "test:unit:node": "jest --selectProjects node",