File Explorer

1.TH "NPM-APPROVE-SCRIPTS" "1" "June 2026" "NPM@11.17.0" ""2.SH "NAME"3\fBnpm-approve-scripts\fR - Approve install scripts for specific dependencies4.SS "Synopsis"5.P6.RS 27.nf8npm approve-scripts <pkg> \[lB]<pkg> ...\[rB]9npm approve-scripts --all10npm approve-scripts --allow-scripts-pending11.fi12.RE13.P14Note: This command is unaware of workspaces.15.SS "Description"16.P17Manages the \fBallowScripts\fR field in your project's \fBpackage.json\fR, which records which of your dependencies are permitted to run install scripts (\fBpreinstall\fR, \fBinstall\fR, \fBpostinstall\fR, and \fBprepare\fR for non-registry sources). This command is the recommended way to maintain that field.18.P19In the current release, this field is advisory: install scripts still run by default, but installs print a list of packages whose scripts have not been reviewed. A future release will block unreviewed install scripts.20.P21This command only works inside a project that has a \fBpackage.json\fR. Running it with \fB--global\fR (\fB-g\fR) fails with an \fBEGLOBAL\fR error, since global installs (\fBnpm install -g\fR) and one-off executions (\fBnpm exec\fR / \fBnpx\fR) have no project \fBpackage.json\fR to write to. To allow install scripts in those contexts, use the \fB--allow-scripts\fR flag at install time (for example \fBnpm install -g --allow-scripts=canvas,sharp\fR) or persist the setting with \fBnpm config set allow-scripts=canvas,sharp --location=user\fR.22.P23There are three modes:24.P25.RS 226.nf27npm approve-scripts <pkg> \[lB]<pkg> ...\[rB]28npm approve-scripts --all29npm approve-scripts --allow-scripts-pending30.fi31.RE32.P33\fB<pkg>\fR matches every installed version of that package. By default the command writes pinned entries (\fBpkg@1.2.3\fR), which keep their approval narrowed to the specific version you reviewed. Pass \fB--no-allow-scripts-pin\fR to write name-only entries that allow any future version.34.P35\fB--all\fR approves every package with unreviewed install scripts in one go.36.P37\fB--allow-scripts-pending\fR is read-only: it lists every package whose install scripts are not yet covered by \fBallowScripts\fR, without modifying \fBpackage.json\fR.38.P39\fBapprove-scripts\fR honours the asymmetric pin rule: if you re-approve a package whose installed version has changed, the existing pin is rewritten to track the new installed version. Multi-version statements (\fBpkg@1 || 2\fR) are left alone, since they likely capture intent that the command cannot infer. Existing \fBfalse\fR entries always win; \fBapprove-scripts\fR will not silently re-allow a package you previously denied.40.SS "Examples"41.P42.RS 243.nf44# Approve all currently-installed install scripts after reviewing them45npm approve-scripts --all46 47# Approve specific packages, pinned to their installed version48npm approve-scripts canvas sharp49 50# Approve name-only (any version of this package is allowed)51npm approve-scripts --no-allow-scripts-pin canvas52 53# Preview which packages still need review54npm approve-scripts --allow-scripts-pending55.fi56.RE57.SS "Configuration"58.SS "\fBall\fR"59.RS 060.IP \(bu 461Default: false62.IP \(bu 463Type: Boolean64.RE 065 66.P67Show or act on all packages, not just the ones your project directly depends on. For \fBnpm outdated\fR and \fBnpm ls\fR this lists every outdated or installed package. For \fBnpm approve-scripts\fR and \fBnpm deny-scripts\fR it selects every package with pending install scripts.68.SS "\fBallow-scripts-pending\fR"69.RS 070.IP \(bu 471Default: false72.IP \(bu 473Type: Boolean74.RE 075 76.P77List packages with install scripts that are not yet covered by the \fBallowScripts\fR policy, without modifying \fBpackage.json\fR. Only meaningful for \fBnpm approve-scripts\fR.78.SS "\fBallow-scripts-pin\fR"79.RS 080.IP \(bu 481Default: true82.IP \(bu 483Type: Boolean84.RE 085 86.P87Write pinned (\fBpkg@version\fR) entries when approving install scripts. Set to \fBfalse\fR to write name-only entries that allow any version. Has no effect on \fBnpm deny-scripts\fR, which always writes name-only entries regardless of this setting.88.SS "\fBjson\fR"89.RS 090.IP \(bu 491Default: false92.IP \(bu 493Type: Boolean94.RE 095 96.P97Whether or not to output JSON data, rather than the normal output.98.RS 099.IP \(bu 4100In \fBnpm pkg set\fR it enables parsing set values with JSON.parse() before saving them to your \fBpackage.json\fR.101.RE 0102 103.P104Not supported by all npm commands.105.SS "See Also"106.RS 0107.IP \(bu 4108npm help deny-scripts109.IP \(bu 4110npm help install111.IP \(bu 4112npm help rebuild113.IP \(bu 4114\fBpackage.json\fR \fI\(la/configuring-npm/package-json\(ra\fR115.RE 0116