From bf5d2ada71ba30ee40c91e6207892254a16968db Mon Sep 17 00:00:00 2001
From: Max Ostapenko <1611259+max-ostapenko@users.noreply.github.com>
Date: Wed, 9 Sep 2026 13:33:05 +0200
Subject: [PATCH] security: disable automatic lifecycle scripts during npm
 install

---
 .npmrc              | 3 +++
 test-project/.npmrc | 3 +++
 2 files changed, 6 insertions(+)
 create mode 100644 .npmrc
 create mode 100644 test-project/.npmrc

diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..7d4647e
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,3 @@
+# Disable automatic execution of dependency lifecycle scripts during install/ci
+# Mitigates supply-chain compromise risks from malicious package install scripts
+ignore-scripts=true
diff --git a/test-project/.npmrc b/test-project/.npmrc
new file mode 100644
index 0000000..7d4647e
--- /dev/null
+++ b/test-project/.npmrc
@@ -0,0 +1,3 @@
+# Disable automatic execution of dependency lifecycle scripts during install/ci
+# Mitigates supply-chain compromise risks from malicious package install scripts
+ignore-scripts=true