allowScripts / strict-allow-scripts appear to be inert (no @lavamoat/allow-scripts present)

Start with package.json, .npmrc, and DEPENDENCY_POLICY.md, then run npm install --no-audit --no-fund with the pinned npm version. Confirm whether the allowlist is consumed and whether the configuration warning remains. Done means the project’s intended install-script policy is decided, documented, and verified without overlooking koffi’s native install step.

Summary

The install-script allowlist appears to be inert. Nothing in the repo consumes either half of it, so the packages in allowScripts are not actually being gated.

Detail

package.json declares:

"allowScripts": {
  "electron-winstaller@5.4.0": true,
  "esbuild@0.28.2": true,
  "koffi": true,
  "libxmljs2@0.37.0": true
}

and .npmrc sets:

strict-allow-scripts=true

Both of these are the @lavamoat/allow-scripts convention, but that package is not in devDependencies, is not installed, and there is no preinstall/prepare hook invoking allow-scripts.

strict-allow-scripts is also not an npm config key. On npm 11.12.1 it is reported directly:

npm warn Unknown project config "strict-allow-scripts".
This will stop working in the next major version of npm.

So install scripts for those packages currently run under plain npm rules, unrestricted.

This seemed worth raising rather than patching, because the fix isn't obviously mine to choose:

• Adding @lavamoat/allow-scripts is a dependency change, which triggers the full review gate in DEPENDENCY_POLICY.md.
• Switching to npm's real ignore-scripts=true would likely break koffi's native install step.

Both are judgement calls about the intended threat model, so I'd rather ask than guess.

Reproduce

npm install --no-audit --no-fund

Observe the Unknown project config warning, and that node_modules/@lavamoat does not exist.

Environment

npm 11.12.1 on Windows (below the pinned 11.19.0 — worth confirming whether 11.19.0 recognizes the key, though I can't find it in npm's config schema).