How do you approve only trusted install scripts in npm?

The current npm CLI documentation describes an allowScripts field in package.json that records which dependencies may run install scripts, managed with npm approve-scripts. The docs say the field is currently advisory: installs still run scripts but list unreviewed packages. Check your npm version before relying on it.

What the documentation says

The npm approve-scripts page says the command manages the allowScripts field, which records which dependencies may run preinstall, install, postinstall and prepare for non-registry sources. It calls the command the recommended way to maintain the field.

Key behaviors from the pages:

• npm approve-scripts <pkg> approves named packages, pinned to the installed version such as pkg@1.2.3 by default.
• --all approves every package with pending scripts.
• --allow-scripts-pending lists unapproved packages without changing package.json.
• npm deny-scripts writes name only denial entries.
• The command is not aware of workspaces.
• The docs say the field is advisory for now, and that a future release will block unreviewed scripts.

The config reference adds strict-allow-scripts. When true, unreviewed install scripts fail the install instead of running with a notice. Explicitly denied entries are skipped silently. The page also says --ignore-scripts overrides the allow settings, and calls dangerously-allow-all-scripts strongly discouraged.

The reference does not state which npm version introduced these settings, so confirm with npm --version and the docs for your release.

Why a policy beats a blanket flag

Setting ignore-scripts to true stops all install scripts, including ones a package needs to work, such as a native build. Teams often turn it off again after one broken install. A policy lets you say yes to the three packages that need scripts and no to the rest. It also gives reviewers a diff: a new entry in allowScripts is a visible event.

A workflow

1. Run npm approve-scripts --allow-scripts-pending to see what would run.
2. For each package, read what the script does and decide.
3. Approve the packages you trust with npm approve-scripts <pkg>, and deny the rest with npm deny-scripts.
4. Commit the package.json change in its own pull request with a reason.
5. Turn on strict-allow-scripts in a trial branch to see what would fail.
6. When a version bump changes an approved package, review again, because pins follow the installed version.

Limits to keep in mind

An approved script is still code from a package, so approval is a review decision, not proof of safety. Malicious code can also run when a package is imported, not only at install time, as covered in the post on reviewing install scripts. Combine the policy with a release delay, see dependency cooldown periods.

Safeguard scans dependencies and can flag packages with install scripts in your inventory. Try a free scan.

Quick check

Sources

• npm approve-scripts
• npm config reference

Last reviewed: 19 October 2026.