npm v12 Ships This Month, Blocking the Install Scripts That Fueled a Year of Supply Chain Attacks

npm v12 ships this month with the package manager’s most significant security redesign in its 16-year history — and it changes default behavior in ways that will break builds that aren’t prepared.

Three defaults flip. First, npm install will no longer execute preinstall, install, or postinstall scripts from dependencies unless you explicitly allow them. Second, it will no longer resolve Git dependencies without the --allow-git flag. Third, it will no longer pull dependencies from remote URLs — HTTPS tarballs included — without --allow-remote. All three attack surfaces have been abused in real campaigns over the past year.

The trigger is a string of supply chain incidents GitHub is done tolerating. A September 2025 compromise hit 18 major packages — including debug and chalk, with a combined 2.6 billion weekly downloads — through exactly this kind of install-script abuse. A March 2026 Axios compromise used postinstall hooks for credential theft. Roughly 455,000 malicious packages were published to the ecosystem in 2025 alone. Install scripts, which run arbitrary code the moment npm install finishes, have been the common thread.

npm 11.16.0 and later already ship the new behavior behind warnings, so you can audit before the breaking change lands. Run npm approve-scripts --allow-scripts-pending to see which of your dependencies currently ship install scripts. Review each one — don’t blanket-approve — and commit the updated package.json so the allowlist travels with your repo. If you maintain a package that legitimately needs an install step (native bindings, for example), document that requirement in your README now, and look at shipping prebuilt binaries via prebuild or node-pre-gyp instead of relying on postinstall compilation.

The practical risk for most teams isn’t malice, it’s silent breakage: any CI pipeline or Docker build that depends on an install script running unannounced will fail hard the day v12 lands, not with a warning but with a missing native module or an incomplete build. Audit now, not in July when the upgrade actually rolls out. For monorepos with dozens of transitive dependencies pulling from Git or private registries, budget real time for this — the flag-by-flag opt-in model means every remote or Git dependency needs an explicit decision, not just the ones you wrote yourself.

Sources

Related reading