v1.0.0 — the install-script governance tool for npm, pnpm, yarn & bun

npm-script-lens started as "show me what this install script does before I approve it." v1.0.0 is the whole workflow around that question — across every major package manager, from a developer's editor to CI to AI agents.

One tool, four ecosystems

Behavioral analysis already ran on npm, pnpm, yarn, and bun lockfiles. Now the write side does too: allow/review/sync reconcile each manager's native opt-in — npm allowScripts, pnpm allowBuilds, yarn dependenciesMeta.built, bun trustedDependencies. All four verified end-to-end against the real binaries.

What's new since 0.5.0

• allow — one-shot classifier that auto-approves SAFE/LOW scripts and holds MEDIUM/HIGH/malicious for review; --write to the native allowlist, --ci-check to fail builds that npm v12 would silently break.
• review — shows npm v12's pending set plus the actual file contents the scripts run, with the behavioral verdict, OSV, and trust.
• doctor — self-diagnoses drift from npm's internals and exits non-zero when it stops understanding your npm.
• Governance — script-lens.policy.json: max risk, denied capabilities, minimum publish age, required provenance, per-package waivers.
• CI & local — GitHub Action ci-check + sync-check, an auto-fix bot for Renovate/Dependabot branches, init --hook pre-commit, and two drift-canary workflows.
• Editors — a VS Code extension (risk surfaced inline on package.json) and a Neovim plugin.
• Reporting — Markdown, JSON, SARIF, and a self-contained HTML dashboard (audit --html).
• AI — MCP server with audit_package, audit_lockfile, classify_allowscripts.

Install

npx npm-script-lens audit --fail-on-high

128 tests, all four package managers live-verified. Full detail in CHANGELOG.md.