Post

npm now has the ability to approve/deny scripts per-package just like pnpm 🎉

Right now this doesn’t do anything: „In the current release, install scripts still run by default, so deny-scripts only affects how installs of denied packages are reported. A future release will block unreviewed install scripts and respect deny entries at install time.“ From the deny-scripts doc

I am not at the laptop so I can’t test it right now. Have you tested it ? The documentation of this config is still weird: Dependencies explicitly denied with false in allowScripts are always silently skipped; this setting only affects unreviewed entries. The first sentence is not true with <v12

Thanks for the heads up. I'll fix the docs tomorrow.

i have indeed! and it does what it says on the tin good times? 😀

🎉🎉🎉🎉 yeah!