For most application teams, yes: set allow-git to root or none. The npm config reference describes it as a source restriction on whether npm fetches dependencies from git references. With root, only git dependencies in your own package.json are allowed, so a transitive package cannot pull code from a repository.
What the setting does
According to the npm config reference, allow-git defaults to all and accepts three values:
| Value | Effect |
|---|---|
| all | Any git dependency is allowed. This is the default |
| root | Only git dependencies declared in the project's own package.json are allowed |
| none | Git dependencies are blocked |
The page also says changing it does not remove dependencies that are already installed. It is a source restriction, not an install script allow list. Confirm the setting exists in your npm version, because the reference does not give the release in which it was added.
Why git sources are different
A package from the registry has a published version, a checksum in the lockfile, and a place in the registry's history. A git reference may point at a branch or tag that can move. Even when a lockfile records a commit, reviewers have a harder time seeing what changed, and the code was not published through the registry's publishing controls. A transitive dependency that points at a git repository adds a source you may never have reviewed.
This is also a way for build time code to appear. Packages fetched from git can run a prepare step during install. The npm approve-scripts docs list prepare for non registry dependencies among the lifecycle scripts the allow policy covers, which shows why git sources deserve extra care.
How to roll it out
- Find current git dependencies. Search the lockfile for entries whose resolved field points at a git URL, or run
npm ls --alland look for git sources. - Decide for each: replace with a registry release, pin to a full commit hash, or keep and document why.
- Set
allow-git=rootin the project.npmrcand run a clean install in CI. - If the install fails, the error tells you which transitive package needs a git source. Decide whether to override it or replace the parent.
- Move to
noneif no git dependencies remain. - Commit the
.npmrcso every developer and CI job uses the same setting.
Things to watch
Pin any git dependency you keep to a full commit hash, not a branch name. Use npm overrides where a transitive package needs replacing. Remember that the setting only governs how npm fetches, and other package managers have their own options.
What it does not protect against
A registry package can still be malicious, so keep scanning. This setting reduces one source of surprise, in the same family as reviewing install scripts and a release delay.
Safeguard dependency scanning reports each package in your tree along with its source, and you can start with a free scan.
Quick check
Does allow-git remove git dependencies that are already installed?
No. The npm docs say changing it does not remove dependencies already installed.
What is the default value?
all, which permits any git dependency.
Sources
Last reviewed: 19 October 2026.
