NPM-APPROVE-SCRIPTS(1)

💅 npm-approve-scripts — NPM-APPROVE-SCRIPTS(1)

okay so bestie, welcome to the npm-approve-scripts page from the NPM-APPROVE-SCRIPTS(1) manual — this is the one that lets your deps run their install scripts, and only the ones you actually said yes to ✨

🌸 NAME

npm-approve-scripts — approve install scripts for specific dependencies 🫶

✨ Synopsis

npm approve-scripts <pkg> [<pkg> ...]
npm approve-scripts --all
npm approve-scripts --allow-scripts-pending

heads up: this command is unaware of workspaces. it's giving "solo project only" energy, no cap 🙈

💖 Description

so this command is the whole vibe-check manager for the allowScripts field in your project's package.json — that's the field that records which of your dependencies are allowed to run install scripts (preinstall, install, postinstall, and prepare for non-registry sources). this command is literally the recommended way to maintain that field, periodt 💅

dependency install scripts are blocked by default. install commands silently skip lifecycle scripts for any dependency that doesn't have a matching entry in allowScripts, and then they end with a list of the packages whose scripts were skipped — so you can review them with this command 👑

this command only works inside a project that has a package.json. running it with --global (-g) fails with an EGLOBAL error, because global installs (npm install -g) and one-off executions (npm exec / npx) have no project package.json to write to 😭

to allow install scripts in those contexts, use the --allow-scripts flag at install time (for example npm install -g --allow-scripts=canvas,sharp) or persist the setting with npm config set allow-scripts=canvas,sharp --location=user 🎀

there are three modes, and yes you need to know all three:

npm approve-scripts <pkg> [<pkg> ...]
npm approve-scripts --all
npm approve-scripts --allow-scripts-pending

<pkg> matches every installed version of that package. by default the command writes pinned entries (pkg@1.2.3), which keep their approval narrowed to the specific version you reviewed 🦋

pass --no-allow-scripts-pin to write name-only entries that allow any future version. main character energy, but risky, iykyk.

--all approves every package with unreviewed install scripts in one go 🔥

--allow-scripts-pending is read-only: it lists every package whose install scripts are not yet covered by allowScripts, without modifying package.json. it's giving "look, don't touch" 🌸

approve-scripts honours the asymmetric pin rule: if you re-approve a package whose installed version has changed, the existing pin is rewritten to track the new installed version. multi-version statements (pkg@1 || 2) are left alone, since they likely capture intent that the command cannot infer 🙈

existing false entries always win — approve-scripts will not silently re-allow a package you previously denied. respect the boundary bestie 💀

ngl, there's one cursed edge case: if a registry dependency has no resolved URL in your package-lock.json (for example, an older lockfile or one written with omit-lockfile-registry-resolved), npm cannot verify a trusted version for it and cannot pin it. a pkg@1.2.3 entry never matches, so the package keeps appearing under --allow-scripts-pending. approve-scripts approves these by name (pkg: true) and warns when it does. to restore pinning, refresh the lockfile with npm install 🧚

🎀 Examples

# Approve all currently-installed install scripts after reviewing them
npm approve-scripts --all

# Approve specific packages, pinned to their installed version
npm approve-scripts canvas sharp

# Approve name-only (any version of this package is allowed)
npm approve-scripts --no-allow-scripts-pin canvas

# Preview which packages still need review
npm approve-scripts --allow-scripts-pending

💅 Configuration

all

• Default: false
• Type: Boolean

show or act on all packages, not just the ones your project directly depends on. for npm outdated and npm ls this lists every outdated or installed package. for npm approve-scripts and npm deny-scripts it selects every package with pending install scripts ⭐

allow-scripts-pending

• Default: false
• Type: Boolean

list packages with install scripts that are not yet covered by the allowScripts policy, without modifying package.json. only meaningful for npm approve-scripts 🦋

allow-scripts-pin

• Default: true
• Type: Boolean

write pinned (pkg@version) entries when approving install scripts. set it to false to write name-only entries that allow any version. has no effect on npm deny-scripts, which always writes name-only entries regardless of this setting 👑

json

• Default: false
• Type: Boolean

whether or not to output JSON data, rather than the normal output 💖

• in npm pkg set it enables parsing set values with JSON.parse() before saving them to your package.json.

not supported by all npm commands 🌈

🌟 See Also

• npm help deny-scripts
• npm help install
• npm help rebuild
• package.json ⟨/configuring-npm/package-json⟩

---

okay that's the whole page bestie, go approve some scripts responsibly 🫶 from NPM@12.2.1, dated October 2026, and filed under NPM-APPROVE-SCRIPTS(1) — slay, bye 💜