Repository navigation
[BUG] Blocked postinstall execution for remote installation - allowScripts not recognized (npm@12.0.0) #9738
Description
- follows on from [BUG] ENOMATCH "no trusted identity for policy key" for
install-scriptsafter remote install #9723 for npm 11.18.0
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
This is not just a request to bump a dependency for a CVE
- This is not solely a request to bump a dependency for a CVE
Current Behavior
npm 12.0.0 blocks postinstall execution after installing from remote URL
ENOMATCH warning
does not recognize existing allowScripts
added 169 packages, and audited 170 packages in 24s
53 packages are looking for funding
run `npm fund` for details
found 0 vulnerabilities
npm warn install-scripts 1 package had install scripts blocked because they are not covered by allowScripts:
npm warn install-scripts cypress@15.18.1 (postinstall: node dist/index.js --exec install)
npm warn install-scripts
npm warn install-scripts Run `npm install-scripts ls` to review, or `npm install-scripts approve <pkg>` to allow.
cy-npm-install-test@ /home/mike/github/TESTING/cy-npm-install-test
└── cypress@15.18.1
npm warn install-scripts skipping cypress: no trusted identity for policy key
npm error code ENOMATCH
npm error No installed packages match: cypress
npm error A complete log of this run can be found in: /home/mike/.npm/_logs/2026-07-09T04_40_55_501Z-debug-0.log
In the case of Cypress, the workaround is to run npx cypress install to manually run the postinstall script.
Expected Behavior
npm should allow installation from a remote CDN and accept the allowScripts setting. If additional configs are necessary for this to work, then they should be documented.
Steps To Reproduce
Execute the following:
cat > package.json <<EOT
{
"allowScripts": {
"cypress": true
}
}
EOT
npm set allow-remote=all --location=project
rm -rf ~/.cache/Cypress
npm install https://cdn.cypress.io/beta/npm/15.18.1/linux-x64/develop-8addb93e04dd372ab736d76c60735711d570312e/cypress.tgz
npm ls cypress
npm install-scripts approve cypressSee also https://docs.cypress.io/app/references/advanced-installation#Install-pre-release-version
Environment
- npm: 12.0.0
- Node.js: 26.5.0
- OS Name: Ubuntu 26.04 LTS
- System Model Name: HP x64 desktop
- npm config:
; "project" config from /home/mike/github/TESTING/cy-npm-install-test/.npmrc
allow-remote = "all"
; node bin location = /home/mike/n/bin/node
; node version = v26.5.0
; npm local prefix = /home/mike/github/TESTING/cy-npm-install-test
; npm version = 12.0.0
; cwd = /home/mike/github/TESTING/cy-npm-install-test
; HOME = /home/mike
; Run `npm config ls -l` to show all defaults.
Activity
martinrrm commentedon Jul 13, 2026
Hi! I'm still investigating but I believe this is a valid bug in the command. The complication is that Cypress was installed directly from a remote tarball rather than from the npm registry. For security, npm cannot use the package name declared inside an arbitrary remote tarball as its trusted identity. Consequently, an entry such as:
{ "allowScripts": { "cypress": true } }does not authorize this particular installation. The trusted identity for a direct remote tarball is its exact resolved URL.
The
cypressargument tonpm install-scripts approve cypressis only intended to select the installed package. npm should then automatically write the trusted URL intoallowScripts. The bug is that npm failed to derive that URL, skipped the package withno trusted identity for policy key, and then returnedENOMATCH.Please try this: replace the name-only entry with the exact tarball URL:
{ "allowScripts": { "https://cdn.cypress.io/beta/npm/15.18.1/linux-x64/develop-8addb93e04dd372ab736d76c60735711d570312e/cypress.tgz": true } }This should be able to unblock you while we investigate further
MikeMcC399 commentedon Jul 14, 2026
Thanks for the additional instructions, which I confirm are successful!
MikeMcC399 commentedon Aug 3, 2026
#9794 refers to this issue