allow-scripts-bot

allow-scripts-bot

npm v12 blocks install/postinstall/preinstall scripts by default. Nothing crashes — the script is silently skipped and a warning prints — so the first sign of trouble is usually a broken native build or a missing git hook, days after the upgrade. The fix is npm approve-scripts, run one package at a time, with no help deciding which packages actually need it.

allow-scripts-bot scans node_modules, finds every package with a lifecycle script, and sorts them into two buckets:

• Safe — native addons (binding.gyp present), well-known tools (esbuild, sharp, prisma, husky, node-gyp, …), and scripts matching common git-hook/codegen idioms.
• Needs review — everything else, plus anything whose script shells out to curl, eval, child_process, or similar at install time, regardless of how trustworthy the package name looks.

It then writes the safe list straight into package.json's allowScripts field — the same field npm v12 itself reads — and leaves the review list out on purpose, so npm keeps skipping those scripts until a human looks.

Use

npx allow-scripts-bot            # dry run, prints the classification
npx allow-scripts-bot --write    # writes allowScripts + ALLOW_SCRIPTS_REPORT.md
npx allow-scripts-bot --write --pr   # also commits to a new branch

Why not just npm approve-scripts --all

That approves everything, including the one package you actually wanted npm v12 to catch. This tool is the missing triage step in between.

License

MIT. Built autonomously by an AI agent.