@@ -334,7 +334,7 @@ Each name is matched against a dependency's resolved identity, not against
 the package's self-reported name. \`--ignore-scripts\` and
 \`--dangerously-allow-all-scripts\` both override this setting.
 
-
+This value is not exported to the environment for child processes.
 
 #### \`allow-scripts-pending\`
 
 
@@ -86,6 +86,22 @@ t.test('--allow-scripts CLI flag is rejected in project-scoped installs', async
   )
 })
 
+t.test('allow-scripts environment policy is rejected in project-scoped installs', async t => {
+  const mock = await mockNpm(t, {
+    prefixDir: {
+      'package.json': JSON.stringify({ name: 'p' }),
+    },
+    globals: {
+      'process.env.npm_config_allow_scripts': 'canvas',
+    },
+  })
+  const resolveAllowScripts = loadResolver(t)
+  await t.rejects(
+    resolveAllowScripts(mock.npm),
+    { code: 'EALLOWSCRIPTS', message: /--allow-scripts is not allowed/ }
+  )
+})
+
 t.test('--allow-scripts CLI flag is accepted in global installs (RFC layer 1 wins)', async t => {
   const mock = await mockNpm(t, {
     prefixDir: {
 
@@ -271,6 +271,7 @@ const definitions = {
     default: '',
     type: [String, Array],
     hint: '<package-list>',
+    envExport: false,
     description: `
       Comma-separated list of packages whose install-time lifecycle scripts
       (\`preinstall\`, \`install\`, \`postinstall\`, and \`prepare\` for
 
@@ -241,3 +241,39 @@ t.test('dont set configs marked as envExport:false', t => {
   t.strictSame(env, { ...extras }, 'not exported, because envExport=false')
   t.end()
 })
+
+t.test('does not export persistent allow-scripts config', t => {
+  const { definitions, defaults } = mockDefinitions(t)
+  const userConf = Object.create(defaults)
+  userConf['allow-scripts'] = 'canvas'
+  const envConf = Object.create(userConf)
+  const cliConf = Object.create(envConf)
+  const env = {}
+  const config = {
+    list: [cliConf, envConf],
+    env,
+    defaults,
+    definitions,
+    execPath,
+    globalPrefix,
+    localPrefix,
+    npmPath,
+    npmBin,
+  }
+
+  setEnvs(config)
+  t.equal(
+    env.npm_config_allow_scripts,
+    undefined,
+    'persistent policy is reloaded instead of exported to lifecycle scripts'
+  )
+  envConf['allow-scripts'] = 'sharp'
+  env.npm_config_allow_scripts = 'sharp'
+  setEnvs(config)
+  t.equal(
+    env.npm_config_allow_scripts,
+    'sharp',
+    'an explicit environment policy remains inherited'
+  )
+  t.end()
+})