npm warn allow-scripts: postinstall message triggers this warning on every npm install
Every npm install now prints this warning because of core-js's postinstall script:
npm warn allow-scripts 3 packages have install scripts not yet covered by allowScripts:
npm warn allow-scripts [email protected] (postinstall: node -e "try{require('./postinstall')}catch(e){}")Since core-js is a transitive dependency in most projects (via Babel/core-js-compat), this is unavoidable noise for a huge number of developers on every single install, and it doesn't go away — npm approve-scripts only silences it locally per-project, and CI/fresh clones will keep seeing it.
The script's only purpose is to print the donation message (wrapped in try/catch, no functional effect) — and core-js already has a funding field in package.json pointing to Open Collective, which npm's own npm fund command surfaces natively. So the postinstall script is duplicating a mechanism npm already provides in an opt-in, non-intrusive way.
Would you consider dropping the postinstall script and relying on npm fund (and the funding badge it already produces) instead? That would remove the warning noise without losing the donation ask for anyone who wants to see it.
Source: zloirock/core-js