npm 12: Root 'prepare' script (Husky setup) is bypassed by default ignore-scripts and not targetable by approve-scripts

[xdsl93]

With npm 12+ changing ignore-scripts to true by default, root lifecycle scripts like "prepare": "husky" no longer run automatically after a fresh npm install on a cloned repository.

Context & Problem

In projects adopting npm 12's security defaults:

1. Running npm install skips root prepare scripts.
2. Running npm approve-scripts (or npm install-scripts approve <pkg>) scans third-party package lifecycle scripts (postinstall, etc.), but does not list or approve root prepare scripts declared in the project's own package.json.

This breaks the traditional zero-config DX where fresh clones automatically set up Git hooks upon npm install. Requiring developers to manually run npx husky or altering app-level scripts (e.g. "start": "husky && ..." ) introduces friction and leaves room for human error (unprotected commits on first pull).

Questions

• Is there a recommended pattern for Husky under npm 12 to leverage npm's native script approval workflow without requiring custom wrapper scripts or manual npx husky steps?
• Has there been consideration for providing an opt-in package-level installer/postinstall workflow that can be whitelisted via npm approve-scripts?

Environment

• Husky version: 9.x
• Package Manager: npm 12+ (ignore-scripts=true default)

[dfbustosus]

The premise appears to mix two npm 12 settings. In npm 12, ignore-scripts still defaults to false; the security change blocks unapproved dependency install scripts.

Root lifecycle scripts are intentionally outside npm approve-scripts. A normal npm install or npm ci still runs the root "prepare": "husky" unless ignore-scripts=true was explicitly configured. Husky itself has no lifecycle installer script to approve.

If your organization deliberately enforces ignore-scripts=true, allowScripts cannot override it. Use an explicit trusted step:

npm ci --ignore-scripts
npm run prepare

A trusted repository can alternatively set ignore-scripts=false in its project .npmrc, subject to npm config precedence.

References: https://docs.npmjs.com/cli/v12/using-npm/config/#ignore-scripts and https://typicode.github.io/husky/get-started.html