npm v12 disables auto-run install scripts and remote dependency paths by default

GitHub announced that npm v12 will change default package installation behavior to curb software supply-chain attacks that abuse npm install. The release will require explicit approval before running lifecycle scripts, building native modules with node-gyp, resolving Git-based dependencies, or fetching packages from remote URLs such as HTTPS tarballs. GitHub said the changes remove several automatic code-execution and dependency-resolution paths that attackers have repeatedly used to hide malicious behavior in packages and transitive dependencies executed on developer workstations and CI runners.

The move targets techniques seen in incidents involving malicious preinstall and postinstall scripts, Git dependency abuse, and campaigns tied to packages such as eslint-config-prettier, Toptal’s Picasso packages, and the Shai-Hulud worm. npm maintainers said install-time scripts represent the ecosystem’s largest code-execution surface, though the new defaults will be breaking for some legitimate projects including Playwright, Puppeteer, Electron, and native modules that now must opt in. GitHub urged developers to upgrade to npm 11.16.0 or later ahead of the release so they can receive warnings about workflows that will fail under npm v12’s stricter defaults.