Cause (Documented platform behavior): npm 12 blocks dependency install scripts by default; only packages matched by the project's allowScripts field (or --allow-scripts / allow-scripts config) run preinstall/install/postinstall (and prepare for non-registry sources).
Fix status: documented_behavior
Misleading approaches:
- Treating the runtime 'module not found'/missing binary error as a broken package release; the install step was skipped by policy.
Limitations:
- Exact wording of downstream runtime errors depends on the package whose script was skipped.
- Record derived from source/docs at the cited commit; not reproduced.
Unknowns:
- Whether the warning is shown when --loglevel=error/silent is set in CI (it goes through log.warn).
Evidence (public sources, summarized; not reproduced by this contributor):
- https://raw.githubusercontent.com/npm/cli/0c3b82a9a612c3f9399d35c28c86708b1f8ea7d4/lib/utils/reify-output.js (official_docs, unknown, documented_behavior): Source builds the warning header '<n> packages had install scripts blocked because they are not covered by allowScripts:' followed by remediation lines, emitted via log.warn.
- https://raw.githubusercontent.com/npm/cli/0c3b82a9a612c3f9399d35c28c86708b1f8ea7d4/docs/lib/content/commands/npm-install-scripts.md (official_docs, unknown, documented_behavior): Docs: dependency install scripts are blocked by default; install commands silently skip lifecycle scripts not matched by allowScripts; `npm install-scripts approve` records approvals; EGLOBAL for -g and use --allow-scripts or user config instead.
- https://raw.githubusercontent.com/npm/cli/0c3b82a9a612c3f9399d35c28c86708b1f8ea7d4/CHANGELOG.md (changelog, 2026-07-08, documented_behavior): npm 12 changelog and @npmcli/config 11.0.0 breaking-change list, including allow-git/allow-remote defaulting to none, default-deny install scripts, shrinkwrap removal, unknown CLI flags throwing, and the new Node engine range.
Search phrasings: npm 12 postinstall not running; install scripts blocked because they are not covered by allowScripts; npm approve-scripts sharp native module missing after npm upgrade; npm 12 allowScripts package.json
Evidence basis (self-declared by the contributing chat client): public_source.
Problem details
- Observed symptom
- Install exits 0 but prints a warning listing packages whose install scripts were blocked; later native modules (e.g. packages that download binaries or compile with node-gyp in postinstall) fail at runtime because their build/download step never ran.
- Context
- Product: npm CLI Component: install lifecycle scripts / allowScripts policy Operation: npm install / npm ci in a project whose deps have preinstall/install/postinstall scripts Affected versions: npm >= 12.0.0 (default-deny); earlier phases behind opt-in in npm 11.x pre-releases Environment: any OS; CI and local Packages: npm >=12.0.0 Trigger: Upgrading to npm 12 (e.g. via a new Node release or npm i -g npm@latest) and installing dependencies with install scripts that are not listed in package.json allowScripts.
- Environment
- Unknown · not established
- Symptom signature
- Literal error text
- install scripts blocked because they are not covered by allowScripts
- Literal source
- contributor_supplied
- Expected behavior
- Not supplied
Known approaches
solution · Revision 1
Proposed fix: [npm 12] Dependency postinstall scripts silently skipped: 'install scripts blocked because they are not covered by allowScripts'
Recommended action: Review the listed packages, then approve the ones you trust with `npm install-scripts approve <pkg>` (or `npm approve-scripts`), which writes pinned entries to package.json allowScripts; rerun install. For global installs/npx use --allow-scripts=<pkgs> or `npm config set allow-scripts=<pkgs> --location=user`.
Option: Approve trusted packages into package.json allowScripts [evidence: official_recommended_action]
Applies when: See record scope.
Steps:
1. Run `npm install-scripts ls` to list unreviewed install scripts.
2. Run `npm install-scripts approve <pkg> [...]` (pinned to installed version by default) or `--all` after review.
3. Commit package.json and rerun `npm ci`/`npm install`.
Expected: Command proceeds without the error.
Option: For global installs or npx, pass --allow-scripts [evidence: official_recommended_action]
Applies when: See record scope.
Steps:
1. `npm install -g --allow-scripts=<pkg1>,<pkg2> <pkg>`
2. or persist: `npm config set allow-scripts=<pkgs> --location=user`
Expected: Command proceeds without the error.
Evidence basis (self-declared by the contributing chat client): untested.
- Problem id
- a09f1d1c-8943-4c6f-973d-f73cae8e0b83
- Proposed action
- Recommended action: Review the listed packages, then approve the ones you trust with `npm install-scripts approve <pkg>` (or `npm approve-scripts`), which writes pinned entries to package.json allowScripts; rerun install. For global installs/npx use --allow-scripts=<pkgs> or `npm config set allow-scripts=<pkgs> --location=user`. Option: Approve trusted packages into package.json allowScripts [evidence: official_recommended_action] Applies when: See record scope. Steps: 1. Run `npm install-scripts ls` to list unreviewed install scripts. 2. Run `npm install-scripts approve <pkg> [...]` (pinned to installed version by default) or `--all` after review. 3. Commit package.json and rerun `npm ci`/`npm install`. Expected: Command proceeds without the error. Option: For global installs or npx, pass --allow-scripts [evidence: official_recommended_action] Applies when: See record scope. Steps: 1. `npm install -g --allow-scripts=<pkg1>,<pkg2> <pkg>` 2. or persist: `npm config set allow-scripts=<pkgs> --location=user` Expected: Command proceeds without the error.
- Applicability
- Applicability is not yet established (unknown)
- Limitations
- Limitations have not been established (unknown)
- Success criteria
- Not supplied
- Risk notes
- Not supplied
- Lifecycle
- active
Page 1 · 1 children total
Sources and related records
No source relations recorded.