Post

npm now has the ability to approve/deny scripts per-package just like pnpm 🎉

docs.npmjs.comnpm-approve-scripts | npm DocsApprove install scripts for specific dependencies

Right now this doesn’t do anything: „In the current release, install scripts still run by default, so deny-scripts only affects how installs of denied packages are reported. A future release will block unreviewed install scripts and respect deny entries at install time.“ From the deny-scripts doc

2/6/26, 5:04 pm0 reposts1 like

James

@43081j.com

3 June

James@43081j.com

turn this setting on!

Finn Bayer

@finnbayer.de

3 June

I am not at the laptop so I can’t test it right now. Have you tested it ? The documentation of this config is still weird: Dependencies explicitly denied with false in allowScripts are always silently skipped; this setting only affects unreviewed entries. The first sentence is not true with <v12

Jamie Magee

@jamiemagee.bsky.social

9 June

Thanks for the heads up. I'll fix the docs tomorrow.

Finn Bayer

@finnbayer.de

9 June

Thanks for your work on this topic!

Finn Bayer

@finnbayer.de

3 June

I am super confused. Let’s hope for the best. Will try tomorrow

James

@43081j.com

3 June

i have indeed! and it does what it says on the tin good times? 😀

🎉🎉🎉🎉 yeah!

It seems you are right, it does something in that it reports unreviewed install scripts. But doesn't block them yet. Progress! Hopefully they ship the blocking soon even if it is behind a flag