Function unreviewedScriptsMessage

deps/npm/lib/utils/reify-output.js:234–269

(npm, unreviewedScripts)

}

const unreviewedScriptsMessage = (npm, unreviewedScripts) => {
  if (!unreviewedScripts.length) {
    return
  }

  // Goes through log.warn so it respects --loglevel / --silent and lands
  // on stderr like every other "FYI, here's something to know" message.
  // stdout is reserved for things the user explicitly asked to see
  // (npm ls, npm view).
  const count = unreviewedScripts.length
  const pkg = count === 1 ? 'package has' : 'packages have'
  const header = `${count} ${pkg} install scripts not yet covered by allowScripts:`

  const names = []
  const lines = unreviewedScripts.map(({ node, scripts }) => {
    const { name, version } = trustedDisplay(node)
    /* istanbul ignore next: every test node has a name */
    const display = name || '<unknown>'
    names.push(display)
    const ver = version ? `@${version}` : ''
    const events = Object.entries(scripts)
      .map(([event, cmd]) => `${event}: ${cmd}`)
      .join('; ')
    return `  ${display}${ver} (${events})`
  })

  log.warn(
    'allow-scripts',
    [
      header,
      ...lines,
      '',
      ...remediationLines(npm, names),
    ].join('\n')
  )
}

// `npm approve-scripts` writes to a project package.json, which doesn't
// exist for global installs (it throws EGLOBAL). For those, point users at