npm-script-lens v0.7.0: review shows the actual script, not just its name

npm-script-lens v0.7.0 adds a review subcommand for npm v12's approve-scripts flow.

npm v12's own pending list stops at the script command. review shows, for each package awaiting an allowScripts decision:

• the script command
• the actual code that command runs (from the version-pinned registry tarball, or node_modules with --offline)
• a behavioral scan with its signals (exec / fs / net / env)
• the OSV malware check
• publisher trust (age, downloads, maintainers, provenance)

A real run against a project depending on chalk, core-js, prisma, and sharp:

It finishes with a suggested allowScripts block — HIGH/MEDIUM default to false so you review them before flipping, LOW defaults to true. Read the code, then decide — instead of approving a name blind.

npx npm-script-lens review                        # every pending approval, with evidence
npx npm-script-lens review --output-allowscripts  # write the decisions into package.json

Full docs and the rest of the toolset: github.com/Booyaka101/npm-script-lens