Description

The .npmrc file configures npm's behavior for this project. Here's what each line does:

ignore-scripts = true Prevents npm from automatically running lifecycle scripts (like preinstall, postinstall, prepare, etc.) defined in package.json of installed dependencies. This is a security measure — it stops potentially malicious packages from executing arbitrary code during installation. The tradeoff is that some packages that rely on build scripts (like native modules) won't set themselves up automatically, which is why this project uses yarn setup instead of a plain install.

yes = false Disables automatic "yes" responses to prompts. This ensures npm will actually pause and ask for confirmation on interactive prompts rather than silently accepting defaults — useful to avoid unintended actions during scripted environments.

offline = true Forces npm to only use the local cache and never hit the network. If a package isn't already cached, the install fails rather than fetching it. This is a reproducibility and security measure — it ensures installs are deterministic and prevents supply-chain attacks from packages being silently swapped on the registry.

Changelog

CHANGELOG entry:

Related issues

Fixes:

Manual testing steps

Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]

Screenshots/Recordings

Before

After

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I've included tests if applicable
• I've documented my code using JSDoc format if applicable
• I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Performance checks (if applicable)

• I've tested on Android
  • Ideally on a mid-range device; emulator is acceptable
• I've tested with a power user scenario
  • Use these power-user SRPs to import wallets with many accounts and tokens
• I've instrumented key operations with Sentry traces for production performance metrics
  • See trace() for usage and addToken for an example

For performance guidelines and tooling, see the Performance Guide.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.