[BUG] Incomplete remediate prompt npm install -g --allow-scripts=<package> #9835

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

npm 12.0.2 prompts with "Run npm install -g --allow-scripts=<package> to allow these scripts once" which does not work.

$ npm install -g esbuild

added 2 packages in 3s
npm warn install-scripts 1 package had install scripts blocked because they are not covered by allowScripts:
npm warn install-scripts   esbuild@0.28.1 (postinstall: node install.js)
npm warn install-scripts
npm warn install-scripts Run `npm install -g --allow-scripts=esbuild` to allow these scripts once, or `npm config set allow-scripts=esbuild --location=user` to allow them for all global installs.

$ npm install -g --allow-scripts=esbuild
npm error code ENOENT
npm error syscall open
npm error path /tmp/tmp.j1pwe1SPOy/package.json
npm error errno -2
npm error enoent Could not read package.json: Error: ENOENT: no such file or directory, open '/tmp/tmp.j1pwe1SPOy/package.json'
npm error enoent This is related to npm not being able to find a file.
npm error enoent

The second option npm config set allow-scripts=esbuild --location=user does however work as described.

Expected Behavior

The prompt should provide instructions that work, and possibly it should be changed to start with:

Run npm install -g <package> --allow-scripts=<package>

Steps To Reproduce

Execute the following:

cd $(mktemp -d)
npm install -g esbuild

Environment

• npm: 12.0.2
• Node.js: 26.5.1
• OS Name: Ubuntu 26.04.4 LTS
• System Model Name: HP x64 desktop
• npm config:

; node bin location = /home/mike/n/bin/node
; node version = v26.5.1
; npm local prefix = /tmp/tmp.j1pwe1SPOy
; npm version = 12.0.2
; cwd = /tmp/tmp.j1pwe1SPOy
; HOME = /home/mike
; Run `npm config ls -l` to show all defaults.