GitHub has announced a significant security overhaul for the Node Package Manager (NPM), revealing that version 12 will block the automatic execution of dependency scripts by default. This move, scheduled for release in July, is a direct response to a surge in sophisticated supply chain attacks that have weaponized the npm install process to compromise thousands of developers.
Why NPM Is Changing Its Default Script Execution Policy
The decision follows a series of high-profile incidents involving threat actors known as TeamPCP and the Shai-Hulud self-replicating worm. These campaigns have systematically abused the longstanding default behavior of NPM, where preinstall, install, and postinstall scripts from dependencies run automatically during installation. This mechanism provided a direct code execution path for attackers, allowing them to deploy malware onto developer machines without any explicit user consent.
“npm install will no longer execute preinstall, install, or postinstall scripts from dependencies unless they are explicitly allowed in your project,” GitHub explained in a changelog entry. This change effectively closes a primary vector used in recent supply chain compromises.
What the NPM 12 Security Changes Mean for Developers
The new policy extends beyond standard lifecycle scripts. It will also affect native node-gyp builds, which are commonly used for packages that require compilation. Specifically, packages containing a binding.gyp file without an explicit install script will no longer execute automatically. This is a critical update, as the recent Shai-Hulud Miasma attacks weaponized a binding.gyp file to initiate malicious activity.
Furthermore, Git dependencies—both direct and transitive—will no longer be resolved during npm install unless explicitly permitted. GitHub noted that this closes a code-execution path where a Git dependency’s .npmrc file could override the Git executable, even when the –ignore-scripts flag was used. Similarly, dependencies from remote URLs, including HTTPS tarballs, will be blocked by default in NPM 12.
How to Prepare for the NPM 12 Update
Developers are not being left to navigate this transition without tools. GitHub has provided a clear migration path to ensure projects remain functional while benefiting from the enhanced security posture. The key is to run an audit before the July release.
To check how the upcoming change will impact existing projects, developers can run the command npm approve-scripts –allow-scripts-pending. This command scans the project’s dependencies, identifies which packages have scripts, and allows the developer to approve trusted ones while blocking the rest. The resulting allowlist is written directly to the package.json file.
Once this JSON is committed, developers using NPM version 11.16.0 or later will receive warnings if their install routine attempts to execute scripts that are not on the allowlist. This provides a safety net and a clear signal of what will break after the upgrade.
What Is the Impact of Blocking Scripts in NPM 12?
For the average developer, the most immediate impact will be a change in workflow. Projects that rely on build steps or native compilation during installation will fail unless the necessary scripts are explicitly approved. However, this friction is intentional. It forces a conscious security decision rather than relying on a default that has proven to be a major liability.
GitHub recommends a straightforward preparation process: “Upgrade to NPM 11.16.0 or later, run your normal install, and review the warnings. Use npm approve-scripts –allow-scripts-pending to see which packages have scripts, approve the ones you trust, and commit the updated package.json. After that, only the scripts you approved keep running once you upgrade.”
What Affected Developers Should Do Now
This update represents a fundamental shift in the security model of the NPM ecosystem. Developers and organizations should take immediate steps to prepare. First, upgrade to NPM version 11.16.0 or later to begin receiving warnings about script execution. Second, run a full audit of your project’s dependencies using the npm approve-scripts command to generate an allowlist. Third, review the allowlist carefully, approving only scripts from trusted and verified packages. Finally, commit the updated package.json to your repository. By taking these steps now, you can ensure a smooth transition to NPM 12 and significantly reduce your exposure to supply chain attacks that exploit automatic script execution.
