[BUG] npm update of a single global package requires allow-scripts for all installed packages

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

during npm update for a single global package, it show warning for other global package that are not targeted for update.

Expected Behavior

since npm update is for a single global package, it should not show warning for other packages.

Steps To Reproduce

mkdir -p /tmp/npm-global/lib
export NPM_CONFIG_PREFIX=/tmp/npm-global
npm install -g --allow-scripts=opencode-ai opencode-ai
npm install -g --allow-scripts=yarn yarn
npm update -g --allow-scripts=opencode-ai opencode-ai
rm -rf /tmp/npm-global
unset NPM_CONFIG_PREFIX

during npm update ... command, the following warning is shown:

npm warn install-scripts 1 package had install scripts blocked because they are not covered by allowScripts:
npm warn install-scripts   yarn@1.22.22 (preinstall: :; (node ./preinstall.js > /dev/null 2>&1 || true))
npm warn install-scripts
npm warn install-scripts Run `npm install -g --allow-scripts=yarn` to allow these scripts once, or `npm config set allow-scripts=yarn --location=user` to allow them for all global installs.

Environment

• npm: 12.0.1
• Node.js: v24.18.0
• OS Name: Ubuntu 26.04 LTS
• System Model Name: ThinkPad (intel core i7)
• npm config:

; "user" config from /home/ubuntu/.npmrc

prefix = "/home/ubuntu/.npm-global"

; environment-related config

; NO_PROXY = "localhost,127.0.0.1,10.0.0.0/24"
; HTTPS_PROXY = "http://10.0.0.8:7128"
; HTTP_PROXY = "http://10.0.0.8:7128"

; node bin location = /usr/bin/node
; node version = v24.18.0
; npm local prefix = /home/ubuntu
; npm version = 12.0.1
; cwd = /home/ubuntu
; HOME = /home/ubuntu
; Run `npm config ls -l` to show all defaults.

Start by reproducing the commands in the issue with npm 12.0.1 and Node.js v24.18.0. Trace how a single global-package update evaluates allow-scripts for other installed packages. Done means updating one global package no longer warns about blocked install scripts for unrelated packages, while the reported reproduction remains covered.