[BUG] Verbose and duplicate entries in `allowScripts` created when `install-strategy=linked`

[nikolawork]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

When using install-strategy=linked and adding a package to allowScripts I get weird output:

{
	"allowScripts": {
		"file:../../../vue-demi@0.14.10-pGPQNZuy2Yfs8dw1nOAidw/node_modules/vue-demi": true,
		"file:../../../esbuild@0.28.2-5fSWMmpOnxTxpz8DaF55tQ/node_modules/esbuild": true,
		"file:../../esbuild@0.28.2-5fSWMmpOnxTxpz8DaF55tQ/node_modules/esbuild": true
	}
}

Expected Behavior

When not using a linked install strategy I get concise entries, without duplicates (see the difference for esbuild)

{
	"allowScripts": {
		"vue-demi@0.14.10": true,
		"esbuild@0.28.2": true
	}
}

Steps To Reproduce

1. Create a clean project
2. Add install-strategy = "linked" to the .npmrc
3. Install esbuild
4. Run npm install-scripts approve esbuild
5. Look at the state of allowScripts in package.json

Environment

• npm: 11.19.0
• Node.js: 26.7.0
• OS Name: macOS Sequoia 15.7.9
• System Model Name: Macbook Pro
• npm config:

; "user" config

; min-release-age = 14 ; overridden by project

; "project" config

install-strategy = "linked"
min-release-age = 14

; node bin location = /Users/name/.nvm/versions/node/v26.7.0/bin/node
; node version = v26.7.0
; npm local prefix = /Volumes/projects/project
; npm version = 11.19.0
; cwd = /Volumes/projects/project
; HOME = /Users/name
; Run `npm config ls -l` to show all defaults.

[nikolawork]

cc @manzoorwanijk

[manzoorwanijk]

Yes, I can reproduce it locally, and I am working on a fix. Thank you for reporting it.

[manzoorwanijk]

#9941 should fix it. It would be great if you could help test it and verify the fix.

[nikolawork]

#9798 should fix it. It would be great if you could help test it and verify the fix.

I think you mean #9941?

Would love to help test. How can I install the version from your PR so I can test the fix?

[manzoorwanijk]

I think you mean #9941?

Yeah, that’s right. Sorry for the confusion.

Would love to help test. How can I install the version from your PR so I can test the fix?

Once you checkout the PR, you can replace npm in your commands with node <path/to/cloned/cli>