See what an install script actually does before you approve it: behavioral analysis, binding.gyp inspection and resolved provenance identity for npm 12 allowScripts, pnpm allowBuilds, yarn and bun
nodejs cli npm security static-analysis audit provenance pnpm attestation slsa supply-chain-security sigstore install-scripts lifecycle-scripts allowscripts approve-scripts
-
Updated
Aug 14, 2026 - JavaScript