deno approve-scripts
deno approve-scripts lets you review and approve pending npm lifecycle scripts
(such as postinstall) in your dependency tree. Unlike npm, Deno does not run
these scripts by default for security reasons.
Basic usage Jump to heading
Review and approve pending scripts interactively:
deno approve-scripts
This will show you which packages have lifecycle scripts that haven't been approved yet.
Why lifecycle scripts are blocked by default Jump to heading
npm lifecycle scripts (such as preinstall and postinstall) run arbitrary
code during the install process. This is a known supply chain attack vector —
malicious packages can execute code on your machine just by being installed.
Deno takes a safer approach: lifecycle scripts must be explicitly approved before they run.
approve-scriptsApprove npm lifecycle scripts
Options Jump to heading
--certLoad certificate authority from PEM encoded file.
Configure different aspects of deno including TypeScript, linting, and code formatting.
Typically the configuration file will be called deno.json or deno.jsonc and
automatically detected; in that case this flag is not necessary.
--frozen-lockfileError out if lockfile is out of date.
Load import map file from local file or remote URL.
--lockCheck the specified lock file. (If value is not provided, defaults to "./deno.lock").
--lockfile-onlyInstall only updating the lockfile.
--min-dep-age(Unstable) The age in minutes, ISO-8601 duration or RFC3339 absolute timestamp (e.g. '120' for two hours, 'P2D' for two days, '2025-09-16' for cutoff date, '2025-09-16T12:00:00+00:00' for cutoff time, '0' to disable).
--no-checkSkip type-checking. If the value of "remote" is supplied, diagnostic errors from remote modules will be ignored.
--no-configDisable automatic loading of the configuration file.
--no-lockDisable auto discovery of the lock file.
--no-npmDo not resolve npm modules.
--no-remoteDo not resolve remote modules.
--node-modules-dirSelects the node_modules directory mode for npm packages (not a path). One of: auto (create a local node_modules directory and install npm packages into it), manual (use the existing local node_modules directory, do not modify it), none (do not use a local node_modules directory; resolve npm packages from the global cache). Defaults to auto when the flag is passed without a value.
--node-modules-linkerSets the linker mode for npm packages (isolated or hoisted).
--reload, -rReload source code cache (recompile TypeScript). With no value, reloads everything. Pass a comma-separated list of specifiers to reload only those modules; npm: reloads all npm modules; npm:chalk reloads a single npm module; jsr:@std/http/file-server,jsr:@std/assert/assert-equals reloads specific modules.
--unsafely-ignore-certificate-errorsDANGER: Disables verification of TLS certificates.
--vendorToggles local vendor folder usage for remote modules and a node_modules folder for npm packages.
Last updated on