npm v12: install scripts are now off by default — what it means for your CI

What's changing?

npm v12 flips the previous default: install scripts from dependencies no longer run automatically, only after explicit approval. This covers preinstall, install, postinstall, and implicit node-gyp builds (native modules). It also blocks prepare scripts from git, file and link dependencies. Two related changes, announced back in February 2026, land alongside it: direct or transitive git dependencies no longer resolve without --allow-git (available since npm 11.10.0), and dependencies from remote sources like HTTPS tarballs require --allow-remote (available since npm 11.15.0).

Why it matters

Install scripts have been the preferred execution path for npm supply-chain malware for years — from classic credential stealers to self-propagating worms like the ones documented on this blog (binding.gyp/node-gyp abuse, IronWorm, Miasma). A default that turns scripts off shifts the attack surface substantially: attackers now additionally need to get users to explicitly approve their package, instead of relying on automatic execution on npm install. Important context: this doesn't close every attack vector — the jscrambler incident of 11 July 2026 (see our separate post) shows that from certain versions onward, payloads can run entirely without an install hook, directly at module import. Install-scripts-off is an important line of defense, but not the only one.

What to do now

Before upgrading

# update to npm 11.16.0+ to see warnings
npm install -g npm@11
npm --version
# shows which packages ship install scripts
npm approve-scripts --allow-git-pending

Approve trusted packages

# interactively choose which packages may run scripts
npm approve-scripts
# the result lands in package.json — commit and version it

Prepare CI pipelines

# explicitly test whether the build still passes without automatic scripts
npm ci --ignore-scripts
# for native modules, add an explicit build step instead of relying on postinstall

Check git/remote dependencies

# check whether package.json references git or remote-URL dependencies
grep -E "git\+https|git://|https://.*\.tgz" package.json
# add flags if these dependencies are genuinely needed
npm install --allow-git --allow-remote

Conclusion

npm v12 is one of the biggest structural improvements to npm security in a long time — but not a license to switch off your own vigilance. Anyone who checks lockfiles and CI pipelines for implicit install scripts now and builds a deliberate allowlist will get through the upgrade without breakage while cutting down the still-largest single vector for npm supply-chain incidents.

Sources

• GitHub Changelog — Upcoming breaking changes for npm v12 (9 Jun 2026)
• Tech Times — npm v12 Ships This Month, Blocking Install Scripts That Enabled Year of Supply Chain Attacks (8 Jul 2026)
• Aikido — npm v12 delivers one of the biggest security improvements in years