GitHub npm v12 Disables Install Scripts to Block Supply Chain Attacks

GitHub has announced sweeping "breaking changes" coming to npm version 12, scheduled for release next month, including a default-off setting for install scripts designed to disrupt software supply chain attacks. The move targets attackers who abuse the `npm install` command to trigger malicious code execution via npm lifecycle hooks such as `preinstall`, `install`, and `postinstall`. GitHub described these install-time lifecycle scripts as the "single largest code-execution surface in the npm ecosystem," noting that a single compromised package anywhere in a project's dependency tree can run arbitrary code on a developer machine or CI runner.

Under the new behavior, `npm install` will no longer execute lifecycle scripts from dependencies unless they are explicitly allowed. Git dependencies and remote URL-based dependencies (such as HTTPS tarballs) will also be blocked by default, requiring the `--allow-git` and `--allow-remote` flags, respectively. Native node-gyp builds are caught in the same net, since npm runs an implicit `node-gyp rebuild` for packages containing a `binding.gyp` file. Additionally, defaulting `--allow-git` to `none` closes a known bypass in which a Git dependency's `.npmrc` configuration could override the Git executable even when the `--ignore-scripts` flag was set. Developers preparing for the transition should upgrade to npm 11.16.0 or newer, run a standard install, and use `npm approve-scripts --allow-scripts-pending` to review and explicitly approve trusted packages before committing the updated `package.json`.

This builds on earlier defenses GitHub introduced this year, including the `min-release-age` setting, which instructs npm to reject any package version published less than a specified number of days, a guardrail against freshly minted malicious packages. The supply chain threat has grown sharply, with attackers repeatedly targeting npm to infiltrate downstream projects. Developers and security teams should verify the integrity of their remote dependencies, starting with a quick SSL/TLS checker scan on any third-party tarball sources, and review their environment for residual exposure using a privacy checkup.

Organizations that rely on automated CI/CD pipelines should also audit which packages are allowed to run scripts and ensure that allowlists are tightly scoped. Teams can use a WHOIS lookup to verify the registrant details of lesser-known package authors or maintainer domains before approving elevated privileges. By making script execution opt-in, GitHub is shifting the security burden upstream, forcing maintainers to declare intent rather than rely on implicit trust, a change that should meaningfully reduce the blast radius of the next npm supply chain compromise.