From 5a796b0a3d3ea287bd3317564c4dea3b2ef53449 Mon Sep 17 00:00:00 2001
From: Nicolas Ayral Seydoux <nseydoux@inrupt.com>
Date: Tue, 15 Sep 2026 11:14:18 +0200
Subject: [PATCH] Disable install scripts

Install scripts are a common attack vector, and disabling them by
default is good practice. Required scripts can be re-enabled on a
case-by-case basis.
---
 .github/workflows/api-docs.yml    | 2 +-
 .github/workflows/e2e-browser.yml | 5 +----
 .github/workflows/release.yml     | 1 +
 .npmrc                            | 2 ++
 package.json                      | 1 -
 5 files changed, 5 insertions(+), 6 deletions(-)
 create mode 100644 .npmrc

diff --git a/.github/workflows/api-docs.yml b/.github/workflows/api-docs.yml
index b442179..1c77253 100644
--- a/.github/workflows/api-docs.yml
+++ b/.github/workflows/api-docs.yml
@@ -23,7 +23,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v7
         with:
-          node-version: "20"
+          node-version-file: ".nvmrc"
           cache: "npm"
       - name: Install dependencies
         run: npm ci
diff --git a/.github/workflows/e2e-browser.yml b/.github/workflows/e2e-browser.yml
index 7fbe939..84cb0b4 100644
--- a/.github/workflows/e2e-browser.yml
+++ b/.github/workflows/e2e-browser.yml
@@ -26,12 +26,9 @@ jobs:
           node-version-file: ".nvmrc"
           cache: "npm"
           cache-dependency-path: "**/package-lock.json"
-      # install
-      - run: npm ci --ignore-scripts
+      - run: npm ci
       - run: npx playwright install --with-deps
-      # build
       - run: npm run build
-      # test
       - # Dependabot cannot access secrets, so it doesn't have a token to authenticate to ESS.
         # We want jobs in this workflow to be gating PRs, so the whole matrix must
         # run even for dependabot so that the matrixed jobs are skipped, instead
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bbc6904..bdf53be 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,5 +26,6 @@ jobs:
       # Ensure npm 11.5.1 or later for trusted publishing
       - run: npm install -g npm@latest
       - run: npm ci
+      - run: npm run build
       - run: npm stage publish
       - run: echo "The package has been staged, go to https://www.npmjs.com to publish it."
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..730d526
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,2 @@
+# Prevent supply chain attacks targetting install scripts.
+ignore-scripts=true
diff --git a/package.json b/package.json
index 994dd5f..9e92ad6 100644
--- a/package.json
+++ b/package.json
@@ -16,7 +16,6 @@
     "lint:fix": "npm run lint:eslint -- --fix",
     "lint:check": "npm run lint:eslint",
     "lint:eslint": "eslint --config eslint.config.mjs .",
-    "prepublishOnly": "npm run build",
     "test": "jest --ignoreProjects e2e-node --passWithNoTests",
     "test:unit:browser": "jest --selectProjects browser",
     "test:unit:node": "jest --selectProjects node",