{"id":56487,"date":"2026-06-13T12:00:03","date_gmt":"2026-06-13T16:00:03","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=56487"},"modified":"2026-06-13T12:00:03","modified_gmt":"2026-06-13T16:00:03","slug":"npm-12-blocks-script-execution","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/npm-12-blocks-script-execution\/","title":{"rendered":"NPM 12 Blocks Default Script Execution to Prevent Supply Chain Attacks"},"content":{"rendered":"

GitHub<\/a> has announced a significant security overhaul for the Node Package Manager (NPM), revealing that version 12 will block the automatic execution of dependency scripts by default. This move, scheduled for release in July, is a direct response to a surge in sophisticated supply chain attacks that have weaponized the npm install<\/em> process to compromise thousands of developers.<\/p>\n

Why NPM Is Changing Its Default Script Execution Policy<\/h2>\n

The decision follows a series of high-profile incidents involving threat actors known as TeamPCP and the Shai-Hulud self-replicating worm. These campaigns have systematically abused the longstanding default behavior of NPM, where preinstall<\/em>, install<\/em>, and postinstall<\/em> scripts from dependencies run automatically during installation. This mechanism provided a direct code execution<\/a> path for attackers, allowing them to deploy malware onto developer machines without any explicit user consent.<\/p>\n

\u201cnpm install<\/em> will no longer execute preinstall<\/em>, install<\/em>, or postinstall<\/em> scripts from dependencies unless they are explicitly allowed in your project,\u201d GitHub<\/a> explained in a changelog entry. This change effectively closes a primary vector used in recent supply chain compromises.<\/p>\n

What the NPM 12 Security Changes Mean for Developers<\/h2>\n

The new policy extends beyond standard lifecycle scripts. It will also affect native node-gyp<\/em> builds, which are commonly used for packages that require compilation. Specifically, packages containing a binding.gyp<\/em> file without an explicit install script will no longer execute automatically. This is a critical update, as the recent Shai-Hulud Miasma attacks weaponized a binding.gyp<\/em> file to initiate malicious activity.<\/p>\n

Furthermore, Git dependencies\u2014both direct and transitive\u2014will no longer be resolved during npm install<\/em> unless explicitly permitted. GitHub noted that this closes a code-execution path where a Git dependency\u2019s .npmrc<\/em> file could override the Git executable, even when the \u2013ignore-scripts<\/em> flag was used. Similarly, dependencies from remote URLs, including HTTPS tarballs, will be blocked by default in NPM 12.<\/p>\n

How to Prepare for the NPM 12 Update<\/h3>\n

Developers are not being left to navigate this transition without tools. GitHub has provided a clear migration path to ensure projects remain functional while benefiting from the enhanced security posture. The key is to run an audit before the July release.<\/p>\n

To check how the upcoming change will impact existing projects, developers can run the command npm approve-scripts \u2013allow-scripts-pending<\/em>. This command scans the project\u2019s dependencies, identifies which packages have scripts, and allows the developer to approve trusted ones while blocking the rest. The resulting allowlist is written directly to the package.json<\/em> file.<\/p>\n

Once this JSON is committed, developers using NPM version 11.16.0 or later will receive warnings if their install routine attempts to execute scripts that are not on the allowlist. This provides a safety net and a clear signal of what will break after the upgrade.<\/p>\n

What Is the Impact of Blocking Scripts in NPM 12?<\/h2>\n

For the average developer, the most immediate impact will be a change in workflow. Projects that rely on build steps or native compilation during installation will fail unless the necessary scripts are explicitly approved. However, this friction is intentional. It forces a conscious security decision rather than relying on a default that has proven to be a major liability.<\/p>\n

GitHub recommends a straightforward preparation process: \u201cUpgrade to NPM 11.16.0 or later, run your normal install, and review the warnings. Use npm approve-scripts \u2013allow-scripts-pending<\/em> to see which packages have scripts, approve the ones you trust, and commit the updated package.json. After that, only the scripts you approved keep running once you upgrade.\u201d<\/p>\n

What Affected Developers Should Do Now<\/h2>\n

This update represents a fundamental shift in the security model of the NPM ecosystem. Developers and organizations should take immediate steps to prepare. First, upgrade to NPM version 11.16.0 or later to begin receiving warnings about script execution. Second, run a full audit of your project\u2019s dependencies using the npm approve-scripts<\/em> command to generate an allowlist. Third, review the allowlist carefully, approving only scripts from trusted and verified packages. Finally, commit the updated package.json<\/em> to your repository. By taking these steps now, you can<\/a> ensure a smooth transition to NPM 12 and significantly reduce your exposure to supply chain attacks that exploit automatic script execution.<\/p>\n","protected":false},"excerpt":{"rendered":"

GitHub has announced a significant security overhaul for the Node Package Manager (NPM), revealing that version 12 will block the automatic execution of dependency scripts by default. This move, scheduled for release in July, is a direct response to a surge in sophisticated supply chain attacks that have weaponized the npm install process to compromise […]<\/p>\n","protected":false},"author":7,"featured_media":84934,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/56487.png","fifu_image_alt":"NPM 12 Blocks Default Script Execution to Prevent Supply Chain Attacks","footnotes":""},"categories":[349],"tags":[],"class_list":["post-56487","post","type-post","status-publish","format-standard","has-post-thumbnail","category-articles"],"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/56487.png","fifu_image_alt":"NPM 12 Blocks Default Script Execution to Prevent Supply Chain Attacks","_links":{"self":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/56487","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/comments?post=56487"}],"version-history":[{"count":0,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/56487\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media\/84934"}],"wp:attachment":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media?parent=56487"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/categories?post=56487"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/tags?post=56487"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}