{{ message }}
Repository navigation
namespace the install-script approval commands #9545
Description
Follow-up from RFC #868 (make install scripts opt-in), tracking the command-naming discussion at npm/rfcs#868 (comment).
Background
npm v11.16.0 shipped two top-level commands, npm approve-scripts and npm deny-scripts. Both are thin subclasses of lib/utils/allow-scripts-cmd.js, registered in lib/utils/cmd-list.js. The verb-noun shape came from pnpm (pnpm approve-builds), and it doesn't match how npm normally groups related operations: npm cache <cmd>, npm team <cmd>, npm token <cmd>, npm org <cmd>.
Proposal
Add one namespaced command and keep the verb-noun forms as aliases (they've shipped, so this stays backwards compatible):
npm install-scripts approve <pkg>... | --allnpm install-scripts deny <pkg>...npm install-scripts ls(list unreviewed; see companion issue)npm approve-scripts/npm deny-scriptsalias to the above
Names raised in the thread:
npm install-scripts(favoured by @bakkot)npm scripts(rejected: clashes with thescriptsblock andnpm run)npm trust(rejected:npm trustalready exists)npm hooks,npm lifecycle
@owlstronaut suggested aliasing the current commands and adding the namespace in Phase 2.
Notes
install-scriptssays what it does, so it's the strongest candidate.- A namespace also gives the pending listing a home (
install-scripts ls), which removes the--allow-scripts-pendingambiguity (companion issue). - The native-dependency-patching RFC (#804 #862) made the same move from verb-noun commands to subcommands; keeping these consistent is worth it.
- No RFC needed. The command surface is additive and can be re-aliased later.
Activity
manzoorwanijk commentedon Jun 13, 2026
Thinking more about the naming, I wonder whether
npm scriptsis still the best name for this. The reason is thatnpm install-scriptsreads imperative, just likeallow-remote,allow-scripts,npm install,etc., the correct noun based name should ideally benpm installation-scripts, but that doesn't sound exciting. 😄npm scripts approveandnpm scripts denyread better and, IMHO, represent what they actually deal with - "scripts (from dependencies)", just like--ignore-scripts(for all lifecycle scripts).Otherwise, we could be even more explicit about what it means
npm package-scripts allow/denynpm dependency-scripts approve/denyThat said,
npm scriptsis short and clear.manzoorwanijk commentedon Jun 19, 2026
I want to work on this. Can we please settle the naming?
CC: @owlstronaut
JamieMagee commentedon Jun 23, 2026
Let's go with
install-scripts. We think there is too much overlap withscriptsinpackage.jsonto use it asnpm scripts.ljharb commentedon Jun 23, 2026
That name also properly conveys that it's only install scripts, and not other lifecycle scripts, that are affected.
manzoorwanijk commentedon Jun 24, 2026
Created #9629
feat: namespace install-script approval commands under npm install-sc…
feat: namespace install-script approval commands under npm install-sc…
feat: namespace install-script approval commands under npm install-sc…
feat: namespace install-script approval commands under npm install-sc…
manzoorwanijk commentedon Jun 29, 2026
@JamieMagee @owlstronaut should we change that
npm warn allow-scriptstonpm warn install-scriptsas well?manzoorwanijk commentedon Jun 29, 2026
OK, I have created #9697 to update it.