[BUG] npm approve-scripts --json output issues

[naugtur]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

in some configurations npm prints text instead of JSON to stdout:

• --allow-scripts-pending

$ npm approve-scripts --allow-scripts-pending --json
2 packages have install scripts not yet covered by allowScripts:
  @lavamoat/preinstall-always-fail@1.0.3 (install: (install scripts present))
  not-really-a-package@1.1.0 (install: (install scripts present))

Run `npm approve-scripts <pkg>` to allow, or `npm deny-scripts <pkg>` to deny.

• when allowScripts is already populated

$ npm approve-scripts --all --allow-scripts-pin --json
No packages with unreviewed install scripts.

Expected Behavior

produces JSON like npm approve-scripts --all --json but with "change": "pending" for pending changes and { "allowScripts": [] } for empty result

[Jakeshadow]

This hits anyone automating the allowScripts migration in CI — exactly where --json output matters most.

Workaround until this is fixed:

npm approve-scripts --allow-scripts-pending --json 2>/tmp/npm-stderr.log | jq '.[]'
This separates text warnings (which leak to stderr) from the JSON payload. For a complete CI migration recipe
— including allowScripts in monorepos and Docker builds — I put together: https://npmv12guide.com/ci-cd/.