website/docs: document npm install-script blocking

website/docs/developer-docs/contributing.md

@@ -120,7 +120,7 @@ When you are creating an enhancement suggestion, please fill in [the template](h
 
 authentik can be run locally, although depending on which part you want to work on, different prerequisites are required.
 
-This is documented in the [developer docs](./setup/frontend-dev-environment.md).
+This is documented in the [developer docs](./setup/frontend-dev-environment.mdx).
 
 ### Help with the docs
 

website/docs/developer-docs/setup/_npm-install-scripts-admonition.mdx

@@ -0,0 +1,11 @@
+:::info NPM install scripts are disabled by default
+The repository's NPM runtime configuration file (`.npmrc`) sets `ignore-scripts=true`. This means that `preinstall`/`install`/`postinstall` lifecycle scripts do not run during `npm ci`. This neutralizes a dominant NPM supply-chain attack pattern at the cost of skipping a few legitimate native-binary unpacks.
+
+If the watch build fails because a package needs its install script (commonly `esbuild`, `chromedriver`, `tree-sitter`, or `tree-sitter-json`), rebuild only that package, for example:
+
+```shell
+npm rebuild --foreground-scripts esbuild chromedriver tree-sitter tree-sitter-json
+```
+
+**Do not** edit `.npmrc` to flip `ignore-scripts` off — that re-introduces the risk repository-wide.
+:::

website/docs/developer-docs/setup/frontend-dev-environment.md → website/docs/developer-docs/setup/frontend-dev-environment.mdx

@@ -8,6 +8,8 @@ tags:
     - docker
 ---
 
+import NPMInstallScriptsAdmonition from "./\_npm-install-scripts-admonition.mdx";
+
 If you're focusing solely on frontend development, you can create a minimal development environment using Docker and Node.js. This setup allows you to make and preview changes to the frontend in real-time, without needing to interact with the backend.
 
 ### Prerequisites
@@ -55,6 +57,8 @@ If you're focusing solely on frontend development, you can create a minimal deve
     make web-watch
     ```
 
+    <NPMInstallScriptsAdmonition />
+
 5. In a new terminal, navigate to the cloned repository root and start the backend containers with Docker Compose.
 
     ```shell

website/docs/developer-docs/setup/full-dev-environment.mdx

@@ -11,6 +11,7 @@ tags:
 
 import TabItem from "@theme/TabItem";
 import Tabs from "@theme/Tabs";
+import NPMInstallScriptsAdmonition from "./\_npm-install-scripts-admonition.mdx";
 
 ## Prerequisites
 
@@ -126,6 +127,8 @@ Install all required JavaScript and Python dependencies and create an isolated P
 make install
 ```
 
+<NPMInstallScriptsAdmonition />
+
 ### Generate development configuration
 
 Create a local configuration file that uses the local databases for development: