diff --git a/CHANGELOG.md b/CHANGELOG.md
index 41871bf..3c1e3c5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,40 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Fixed
+- The npm wrapper's `tar` dependency was pinned to `6.2.1`, which npm
+  itself flags as deprecated ("Old versions of tar are not supported,
+  and contain widely publicized security vulnerabilities"). `npm audit`
+  against the published wrapper reports **1 critical and 1 high**
+  vulnerability, all of them in `tar` — the hardlink-path-traversal,
+  symlink-poisoning, and file-smuggling advisories that apply to the
+  archive-extraction path the wrapper uses to unpack the release
+  tarball.
+
+  Bumped to `tar@7.5.22`, which is past the advisory range
+  (`<=7.5.20`). `npm audit` is now clean: **0 vulnerabilities**.
+
+  The bump raises the wrapper's Node floor from 14 to 18, because
+  `tar@7` declares `engines: { node: ">=18" }`. The wrapper's own
+  code is unchanged and still runs on Node 14 — the floor comes from
+  the dependency.
+
+  Verified end-to-end: the wrapper's `extractTarGz` path (with its
+  zip-slip `filter` guard) extracts the real v1.2.2 release archive
+  correctly under `tar@7`, producing the binary at the expected size.
+
+### Added
+- The npm wrapper README (and the main README / installation docs) now
+  explain npm 12's `allowScripts` gate. npm 12 **blocks install
+  scripts** for packages that aren't on an allowlist, and `nodeupx`
+  needs its `postinstall` to download the binary — so on npm 12+ a
+  fresh `npm install -g nodeupx` finishes with the wrapper in place
+  but **no binary** and `nodeup` missing from `$PATH`. The fix is
+  `npm install-scripts approve nodeupx`, which the docs now spell
+  out.
+
 ## [1.2.2] - 2026-11-01
 
 A patch release that **stops the snapshot leak**, gives the user
diff --git a/README.md b/README.md
index 276b599..e793606 100644
--- a/README.md
+++ b/README.md
@@ -104,7 +104,7 @@ scoop install nodeup
 Best for: Windows users who already use Scoop. The manifest is
 auto-managed by GoReleaser from `scoop: {}` in `.goreleaser.yaml`.
 
-#### npm wrapper (any platform with Node ≥ 14)
+#### npm wrapper (any platform with Node ≥ 18)
 
 ```bash
 npm install -g nodeupx
@@ -116,6 +116,12 @@ dormant 2015 package (`romanmt/nodeup` — "a simple cluster
 implementation for node"). The downloaded binary still installs
 as the `nodeup` CLI on your `$PATH`.
 
+> **npm 12+:** npm's `allowScripts` gate blocks install scripts for
+> packages that aren't on an allowlist. `nodeupx` needs its
+> `postinstall` to download the binary, so approve it once:
+> `npm install-scripts approve nodeupx && npm install -g nodeupx`.
+> See [`nodeup-npm/README.md`](./nodeup-npm/README.md#npm-12-approve-the-install-script).
+
 Best for: anyone who treats their global npm install as the source
 of truth for CLI tools — typical in JavaScript / TypeScript projects.
 The wrapper is a thin downloader (`scripts/install.js`) that fetches
diff --git a/docs/installation.md b/docs/installation.md
index b98d1cc..748e21f 100644
--- a/docs/installation.md
+++ b/docs/installation.md
@@ -80,7 +80,7 @@ holds the manifest and is auto-pushed by GoReleaser.
 **Tradeoffs:** user-level install (no admin shell), upgrades via
 `scoop update nodeup`. Same Node-decoupled shape as Homebrew.
 
-### npm wrapper (any platform with Node ≥ 14)
+### npm wrapper (any platform with Node ≥ 18)
 
 ```bash
 npm install -g nodeupx
diff --git a/nodeup-npm/README.md b/nodeup-npm/README.md
index f16b4f4..c7ecab0 100644
--- a/nodeup-npm/README.md
+++ b/nodeup-npm/README.md
@@ -26,6 +26,34 @@ The `postinstall` script downloads a ~6 MB static Go binary into
 `node_modules/nodeup/bin/` and symlinks it onto your global `$PATH`
 as `nodeup`. No Go toolchain, no system services.
 
+Requires **Node ≥ 18** (the `tar` dependency needs it).
+
+### npm 12+: approve the install script
+
+npm 12 added `allowScripts`, which **blocks install scripts** for
+packages that aren't on an allowlist. `nodeupx` needs its
+`postinstall` to download the binary, so on npm 12+ a fresh install
+finishes with the wrapper in place but **no binary** — `nodeup` isn't
+on your `$PATH`, and the install log says:
+
+```
+npm warn install-scripts 1 package had install scripts blocked because they are not covered by allowScripts:
+npm warn install-scripts   nodeupx@1.2.2 (preinstall: node scripts/check.js; postinstall: node scripts/install.js)
+```
+
+Approve the script and re-run the install:
+
+```bash
+npm install-scripts approve nodeupx
+npm install -g nodeupx
+```
+
+To approve it permanently, add it to your `~/.npmrc`:
+
+```ini
+allow-scripts[]=nodeupx
+```
+
 ## Who should use this wrapper
 
 **Pick the npm wrapper if you already live inside Node and want a
diff --git a/nodeup-npm/package.json b/nodeup-npm/package.json
index 5276ea7..2866693 100644
--- a/nodeup-npm/package.json
+++ b/nodeup-npm/package.json
@@ -24,7 +24,7 @@
     "cli"
   ],
   "engines": {
-    "node": ">=14"
+    "node": ">=18"
   },
   "bin": {
     "nodeup": "bin/nodeup"
@@ -34,7 +34,7 @@
     "preinstall": "node scripts/check.js"
   },
   "dependencies": {
-    "tar": "^6.2.1"
+    "tar": "7.5.22"
   },
   "files": [
     "scripts/install.js",
@@ -43,4 +43,4 @@
     "LICENSE"
   ],
   "binaryVersion": "1.2.2"
-}
\ No newline at end of file
+}