Stop dependency install scripts running in CI, and detect new ones

[zerotrustdavid]

Follow-up to #6. Closes a supply chain gap that review did not look at.

The gap

A transitive dependency executes arbitrary Node at install time, on every machine that installs this project and on every deployment build. Nothing in the toolchain examined that. npm audit reports known advisories rather than execution surface, and gitleaks reads content rather than lifecycle hooks. A dependency can acquire a postinstall in a patch release and nothing would say so.

What is actually there

Two install scripts in the whole tree, both dev-only. No production dependency has one:

Package	Chain	What it does
unrs-resolver@1.12.2	eslint-config-next → eslint-import-resolver-typescript → here	Resolves the platform native binding npm has already installed via optionalDependencies, then exits. Reaches the network only when that resolution fails, which is the --no-optional case
fsevents@2.3.3	vitest toolchain	macOS file watching, never installed on Linux

unrs-resolver was verified as a no-op here: running it left the filesystem byte-identical, and the binding resolves without it. It is also not new, despite appearing in a recent build log. It sits at the same version in the lockfile before and after the next@16.3.2 bump.

Two layers

CI installs with --ignore-scripts. This removes the execution path rather than watching it. Verified that a clean --ignore-scripts install still passes lint, tests, palette and build, including lint specifically, which is the only thing that exercises the resolver.

scripts/check-install-scripts.mjs fails the build on anything new. An allowlist where each entry carries the reason it was allowed, so a future failure is read against a recorded standard rather than waved through. Production entries are reported separately, since those run wherever the app is built.

  allowed    node_modules/fsevents@2.3.3 (dev)
  allowed    node_modules/unrs-resolver@1.12.2 (dev)

2 install script(s), all reviewed and allowed.

Runnable locally with npm run check:install-scripts.

Verification, both directions

A check that only ever passes proves nothing, so it was tested failing as well:

Test	Result
Current lockfile	exit 0, both entries allowed
Two install scripts injected into the lockfile	exit 1, both reported, production status flagged
npm ci --ignore-scripts then lint, tests, palette, build	all pass

npm run lint, 155 tests, npm run palette and npm run build all pass on this branch.

Not covered here, and not yet done

The warning that prompted this appeared in the Vercel build log, and Vercel runs its own install. This PR hardens CI only. The deploy path is still executing that postinstall on every production build.

Closing that means setting the Vercel Install Command to npm ci --ignore-scripts. That has not been tested and is not done. It is a change to the deploy pipeline and should be verified on a preview deployment before being trusted on production. Recorded as outstanding rather than complete.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
payreckon	Ready	Preview	Aug 22, 2026 1:47am