Post

npm now has the ability to approve/deny scripts per-package just like pnpm 🎉

It's a phased rollout and It'll be fully usable in the next major release coming soon AFAIK. For now I'd stick to this recommendation lavamoat.github.io/guides/harde...

Could be updated to include the relatively new allow-file, allow-directory and allow-remote flags besides the allow-git one. Or did you purposefully exclude them for some reason ?

They're not ready yet. They're phase 1 of rollout and will be sufficient when npm stops running scripts by default in v12, hopefully very soon. For now it's best to stick to ignore-scripts unless you really know what you're doing

You are misreading allow-scripts. I was talking about the flags that were introduced in v11.15. github.com/npm/cli/comm...

Don't you worry, I'm working on an update to the recommendation. And a tool to put it in place for you, with settings matching your package manager. And more...