From d1c596533f4bd12198d5855b5d2358437b860bd7 Mon Sep 17 00:00:00 2001
From: Mior Muhammad Zaki <crynobone@gmail.com>
Date: Tue, 31 Mar 2026 22:53:53 +0800
Subject: [PATCH] Prevents installed package from executing malicious code via
 `postinstall` (#6777)

---
 composer.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/composer.json b/composer.json
index 0422a1e2..41f874d3 100644
--- a/composer.json
+++ b/composer.json
@@ -36,7 +36,7 @@
             "@php -r \"file_exists('.env') || copy('.env.example', '.env');\"",
             "@php artisan key:generate",
             "@php artisan migrate --force",
-            "npm install",
+            "npm install --ignore-scripts",
             "npm run build"
         ],
         "dev": [