npm postinstall Blocked by Policy - Fix Native Setup Skipped in CI

Some organizations enforce ignore-scripts=true globally for supply-chain safety. That is good policy, but packages that legitimately need postinstall (native builds, binary downloads) end up half-installed unless you rebuild them explicitly.

What this error means

Install succeeds with no error, but a dependency that relies on postinstall is missing its binary/native artifact and fails at runtime. Inspecting config shows a policy-set ignore-scripts=true (in a shared .npmrc or via an env var) that silently skipped the step.

Runtime output

# install completed; later at runtime:
Error: Cannot find module
'/app/node_modules/some-native/build/Release/addon.node'
# postinstall that builds addon.node never ran (ignore-scripts policy)

Common causes

An org/global policy sets ignore-scripts

A shared/global .npmrc, a --ignore-scripts default, or npm_config_ignore_scripts=true in the environment disables all lifecycle scripts, including the ones some packages need.

The blocked package genuinely needs postinstall

Native-addon and binary-wrapping packages do their real install work in postinstall. With it blocked, the runtime files never materialize.

How to fix it

Rebuild the packages that need it

Keep the policy but explicitly rebuild the native packages after install.

Terminal

npm ci            # scripts blocked by policy
npm rebuild       # run install/build steps for native deps explicitly

Allow scripts narrowly where required

Audit which dependencies depend on postinstall before enforcing the policy.
For a trusted, lockfile-pinned set, scope the allowance to the install that needs it rather than disabling the policy globally.
Document why a given package needs its scripts so the exception is reviewable.

How to prevent it

Pair an ignore-scripts policy with an explicit npm rebuild for natives.
Inventory postinstall-dependent packages up front.
Pin dependencies so allowing scripts stays auditable.