NPM-DENY-SCRIPTS(1)

💅 NAME

okay so bestie, this page is npm-deny-scripts — the manual for denying install scripts for specific dependencies. yes that's the whole vibe. let's get into it 🫶

✨ Synopsis

npm deny-scripts <pkg> [<pkg> ...]
npm deny-scripts --all

🚨 real talk: this command is unaware of workspaces. like, it literally does not know they exist. no cap.

---

🌸 DESCRIPTION

it's the companion command to npm help approve-scripts — the ride-or-die counterpart, if you will. what it does is write false entries into the allowScripts field of your project's package.json, recording that a dependency must not run install scripts, even if a future version would otherwise be eligible. it's you putting it in writing. periodt.

dependency install scripts are blocked by default, bestie. so adding a false entry with deny-scripts just makes the denial explicit — which means it survives npm approve-scripts --all, and it also excludes the package from any future --allow-scripts-pending review prompts. so you're not just saying no, you're saying no forever 💀

npm deny-scripts <pkg> [<pkg> ...]
npm deny-scripts --all

<pkg> matches every installed version of that package. and denies are always written name-only ("pkg": false), regardless of --allow-scripts-pin. why? okay so this is the iconic part: pinning a deny to a specific version would silently re-allow scripts for any other version of the same package, which completely defeats the purpose 😭 so the command picks the safer default for you. it's giving main character energy with good judgment.

--all denies every package with unreviewed install scripts. literally all of them. slay.

and if a true (pinned or name-only) entry exists for a package and you then deny it, the existing allow entries get removed so the name-only deny is unambiguous. no messy leftovers, we clean up after ourselves ✨

---

🎀 EXAMPLES

# Deny a specific package outright
npm deny-scripts telemetry-pkg

# Deny everything that has install scripts and isn't already approved
npm deny-scripts --all

---

🦋 CONFIGURATION

all

• Default: false
• Type: Boolean

show or act on all packages, not just the ones your project directly depends on. for npm outdated and npm ls this lists every outdated or installed package. for npm approve-scripts and npm deny-scripts it selects every package with pending install scripts. it's the "i mean business" flag 🌈

allow-scripts-pending

• Default: false
• Type: Boolean

list packages with install scripts that are not yet covered by the allowScripts policy, without modifying package.json. heads up though — this one is only meaningful for npm approve-scripts. deny-scripts is just sitting there like 🧍

allow-scripts-pin

• Default: true
• Type: Boolean

write pinned (pkg@version) entries when approving install scripts. set it to false to write name-only entries that allow any version instead. and here's the tea: it has no effect on npm deny-scripts, which always writes name-only entries regardless of this setting. deny stays name-only. always. 💅

json

• Default: false
• Type: Boolean

whether or not to output JSON data, rather than the normal output. very demure, very structured 🍓

• in npm pkg set it enables parsing set values with JSON.parse() before saving them to your package.json.

⚠️ not supported by all npm commands, bestie. don't come for me.

---

⭐ SEE ALSO

• npm help approve-scripts
• npm help install
• package.json ⟨/configuring-npm/package-json⟩

---

k that's the whole page, go forth and deny those scripts 👑 this has been NPM@12.2.1, dated October 2026 — catch you in the next manual, mwah 🎀💖