npm/cli
Pull Request Overview
- Opened on August 27, 2026
- Status Merged
- Commit count 1 with first commit August 25, 2026
Total Delta
Open Days
Test Delta
How long has this pull request spent in each phase of its lifecycle?
| Fraction of total time | Business days | Phase |
|---|---|---|
| N/A | 3.9 days | Issue creation to work beginning |
|
|
2.0 days | Authoring 1 commit before pull request opened for review |
|
|
0.3 days | Awaiting first review |
|
|
0.4 days | Revising work with 0 commits in response to 1 review that left 0 comments |
|
|
15.0 days | Merge to deploy (still awaiting deployment) |
Total time for pull request
2.7 business days
from first commit authored to merge
Still awaiting deployment
fix(arborist): match allowScripts keys for local paths
Backport of #9914 to release/v11.
Is there an existing issue for this?
- [x] I have searched the existing issues
This issue exists in the latest npm version
- [x] I am using the latest npm
This is not just a request to bump a dependency for a CVE
- [x] This is not solely a request to bump a dependency for a CVE
Current Behavior
I have a local tgz package (a local fork of electron-winstaller) with install scripts in devDependencies. npm v12.0.2 always blocks its install scripts no matter what I have added in allowScirpts inside package.json. I have tried
json
{
"allowScripts": {
"electron-winstaller": true,
"[email protected]": true,
"file:path/to/electron-winstaller-5.3.0.tgz": true,
"file:C:\\absolute\\path\\to\\electron-winstaller-5.3.0.tgz": true,
"file:C:/absolute/path/to/electron-winstaller-5.3.0.tgz": true
}
}
which still results in
``
npm warn install-scripts 1 package had install scripts blocked because they are not covered by allowScripts:
npm warn install-scripts [email protected] (install: node ./script/select-7z-arch.js)
npm warn install-scripts
npm warn install-scripts Runnpm install-scripts lsto review, ornpm install-scripts approve <pkg>` to allow.
```
Below is Claude's analysis:
npm 12's new install-scripts gate matches policy keys against node.resolved using npm-package-arg (npa). For a file: dependency, your lockfile stores the relative form (file:path/to/electron-winstaller-5.3.0.tgz), but when npm loads the actual installed tree (what install/install-scripts ls actually checks against), it re-derives resolved through consistentResolve() (consistent-resolve.js:22-26), which on Windows produces:
file:C:\absolute\path\to\electron-winstaller-5.3.0.tgz β absolute, with backslashes, "file:" glued directly onto them.
The matcher (script-allowed.js:330-333) requires an exact string match against a key parsed by npa(). But npa() always normalizes its saveSpec to forward slashes, and its fetchSpec never carries the file: prefix.
Expected Behavior
npm should allow the scripts to run. Ideally with just the package name match, or relative path match.
Steps To Reproduce
run npm install to install a local tgz npm package with install scripts on Windows.
Environment
- npm: 12.0.2
- Node.js: 22.23.2
- OS Name: Windows 10
- System Model Name: Intel NUC
- npm config:
ini strict-ssl = false allow-git = "all" min-release-age = 7
PR was closed without comments.