This package provides a curated, manually maintained list of common npm packages that legitimately require build scripts (e.g., `preinstall`, `install`, `postinstall`) to function correctly during installation. Its primary purpose is to enhance supply chain security by enabling package managers like pnpm v10 and Bun (which block build scripts by default) to differentiate between necessary and potentially malicious build script executions. The package uses a date-based versioning scheme (e.g., `0.YYYYMMDD.0`) to indicate the last update date, facilitating easy identification of outdated lists. Currently, it is primarily integrated with pnpm v10 via the `onlyBuiltDependenciesFile` and `configDependencies` fields in `package.json`. While efforts are underway to support other package managers through `@lavamoat/allow-scripts`, its current utility is specific to pnpm's security model. The list is not exhaustive, focusing on widely used packages whose build scripts are deemed essential, and requires manual maintenance and updates by users to stay current and effective. It provides a community-driven approach to maintaining a secure dependency graph where build scripts are an unavoidable necessity.
npm install build-scripts-allowlistVerified import paths — ran on the pinned version, not inferred.
This `package.json` snippet demonstrates how to configure pnpm v10 to utilize `build-scripts-allowlist` for securely managing allowed build scripts. It specifies the exact version and integrity hash for security and points to the `common.json` file.
If not using PNPM v10, this package cannot be directly utilized for build script allowlisting. Consider alternative security measures or await broader package manager support.
Always refer to the official GitHub repository's README for the latest version number and integrity hash, and update your `package.json` configuration accordingly to ensure you are using the most secure and up-to-date allowlist.
Report missing packages or potential issues via GitHub issues/pull requests. Users are encouraged to review their dependency trees and understand the build script requirements of their project's specific dependencies, augmenting the allowlist with their own findings if necessary.
Ensure your package manager is configured to block build scripts by default and utilize this allowlist as an exception mechanism. Verify that `onlyBuiltDependencies` is enabled in your pnpm configuration.
First, verify that the `build-scripts-allowlist` configuration in your `package.json` (version and hash) is up-to-date with the latest from the GitHub repository. If the issue persists, and you believe the package should be allowed, consider opening an issue or pull request on the `build-scripts-allowlist` GitHub to propose its inclusion.
Double-check the `onlyBuiltDependenciesFile` path in your `package.json` against the example in the README. Ensure `build-scripts-allowlist` is listed in your project's `dependencies` and that `pnpm install` was run successfully after configuring `configDependencies`.
No dependency data recorded yet.