npm v12 Turns Off Install Scripts by Default
The most significant security change in npm's history stops dependencies from running code at install time unless a team explicitly allows it.
npm v12 shipped in early July 2026, built around a change GitHub had detailed on its official changelog a month earlier, on June 9: `allowScripts` now defaults to off. That means `preinstall`, `install`, and `postinstall` lifecycle scripts declared by a dependency — along with implicit `node-gyp` builds — no longer run automatically. A team has to explicitly allow a package's scripts before npm will execute them.
Two related defaults changed alongside it. `--allow-git` now defaults to `none`, so npm no longer resolves Git-based dependencies, direct or transitive, without explicit permission; that closes a specific attack path where a dependency's own `.npmrc` file could override which Git executable ran, even on a system where script execution was already restricted. `--allow-remote` also defaults to `none`, so dependencies fetched from remote sources like HTTPS tarballs now require the same explicit opt-in.
GitHub's guidance for teams preparing for the change was to upgrade to npm 11.16.0 or later first, since that version surfaces warnings about which installed packages rely on scripts that will stop running. From there, `npm approve-scripts --allow-scripts-pending` lists the pending scripts so a team can review and selectively approve the ones it trusts, then commit the resulting configuration to `package.json`. Packages that legitimately need a native build step, such as ones that compile C++ bindings, still work under the new default — they just require that one-time, explicit approval instead of running unconditionally.
The change is a direct response to a year of npm supply-chain incidents that relied on exactly this mechanism — a malicious package quietly running code the moment it was installed, before any application code ever executed. Turning that behavior off by default doesn't eliminate supply-chain risk, but it removes the specific, silent trigger that a large share of those attacks depended on.
GitHub's changelog entry from June 9, 2026 is the canonical technical breakdown of exactly what changed and how to migrate; npm's own release notes cover the shipped version itself.
Source: GitHub Changelog — Upcoming Breaking Changes for npm v12