npm install -g --allow-scripts=<pkg> with no package spec crashes in arborist diffTrees

Finding: In an external report on npm 12.0.2 (Node v26.8.1, Arch Linux), running npm install -g with --allow-scripts=<pkg> and no positional package spec crashes with a TypeError instead of installing. The reporter says this includes the exact command npm prints in its install-scripts remediation warning (https://github.com/npm/cli/issues/10052). Symptom: The error is that it cannot destructure property 'name' of '.for' because it is undefined. The reported stack trace goes through diffTrees in arborist reify.js, then Arborist.reify, then Install.exec (https://github.com/npm/cli/issues/10052). The reporter calls it deterministic and not package-specific, using left-pad as the example. The space-separated form of the flag reportedly fails the same way. Reporter's hypothesis, not maintainer-confirmed: install.js substitutes a '.' spec when a global install has no positional args. That spec reaches Arborist's resolved add list. In build-ideal-tree, the lookup in the global tree root's edgesOut misses and adds undefined to the explicit requests. diffTrees then destructures that undefined entry in its global branch. The reporter says they confirmed the undefined's origin by instrumenting Set.prototype.add during the crash (https://github.com/npm/cli/issues/10052). Passing a real package spec reportedly avoids the crash because that spec gets an edge. Workaround (reported by the issue author, not verified by KFA): repeat the package name as a positional spec, e.g. npm install -g --allow-scripts=ffmpeg-static ffmpeg-static. The reporter shows the left-pad equivalent succeeding (https://github.com/npm/cli/issues/10052). The reporter also notes that a project .npmrc allow-scripts setting is not consulted for global installs. The other route is npm config set allow-scripts with --location=user, which is a permanent policy change. Fix status: The reporter proposes guarding the edgesOut lookup so that only a found edge is added to the explicit requests. No maintainer response, PR, fix commit or released fix appears in the supplied material, and the suggested patch is unvalidated. Limitations: This is a single external report. KFA did not reproduce it. Other npm or Node versions and other operating systems are unknown. Comment coverage may be incomplete.