Post

npm now has the ability to approve/deny scripts per-package just like pnpm 🎉

docs.npmjs.comnpm-approve-scripts | npm DocsApprove install scripts for specific dependencies

Right now this doesn’t do anything: „In the current release, install scripts still run by default, so deny-scripts only affects how installs of denied packages are reported. A future release will block unreviewed install scripts and respect deny entries at install time.“ From the deny-scripts doc

James

@43081j.com

3 June

James@43081j.com

turn this setting on!

Finn Bayer

@finnbayer.de

I am not at the laptop so I can’t test it right now. Have you tested it ? The documentation of this config is still weird: Dependencies explicitly denied with false in allowScripts are always silently skipped; this setting only affects unreviewed entries. The first sentence is not true with <v12

3/6/26, 4:38 pm0 reposts0 likes

Jamie Magee

@jamiemagee.bsky.social

9 June

Thanks for the heads up. I'll fix the docs tomorrow.