GitHub to Disable npm Script Installs to Block Supply Chain Attacks

Key Takeaways

• GitHub announced upcoming changes to npm, significantly enhancing software supply chain security.
• The npm v12 release, expected in July 2026, will disable automatic execution of installation scripts and restrict external dependency sources by default.
• This change aims to mitigate arbitrary code execution risks from malicious npm packages, requiring explicit developer approval for script execution and non-registry dependencies.
• Developers can prepare by using npm versions 11.10.0-11.16.0 to identify and address potential workflow disruptions.

GitHub has unveiled a critical security overhaul for its Node Package Manager (npm), slated for the npm v12 release in July 2026. These significant breaking changes are engineered to drastically curtail the risk of software supply chain attacks by fundamentally altering how npm handles installation scripts and external dependencies.

Default Script Execution Disabled

A cornerstone of the npm v12 update is the default disabling of automatic script execution during package installation. Historically, preinstall, install, and postinstall scripts have served as a prime vector for threat actors to inject and execute arbitrary malicious code within development environments. With v12, the new allowScripts configuration will be set to off by default, meaning these scripts will only run if explicitly approved by developers.

This restriction extends beyond explicit package scripts. Implicit behaviors, such as the automatic triggering of node-gyp rebuild for native modules containing a Gyp file, will also be blocked. Furthermore, preparing scripts originating from Git, local files, and linked dependencies will require explicit permission to execute.

To assist developers in preparing for these changes, npm provides a command to preview which scripts would be blocked: npm approve-scripts --allow-scripts-pending. Developers can then use npm approve-scripts to allowlist trusted packages or npm deny-scripts to block untrusted ones. The approved script list is stored directly within the package.json file, making it version-controllable and auditable.

Stricter Controls on External Dependencies

npm v12 also introduces heightened scrutiny over external dependency sources. The --allow-git configuration will default to none, preventing npm from resolving Git-based dependencies unless explicitly enabled. Similarly, --allow-remote will also default to none, blocking the installation of packages from remote URLs like HTTPS tarballs.

These enhancements are designed to close critical vulnerabilities where malicious packages could exploit Git dependencies. Attackers have previously demonstrated the ability to abuse .npmrc configurations within Git repositories to override system binaries, even in scenarios where script execution was ostensibly disabled via --ignore-scripts. The new default settings aim to neutralize such bypass techniques.

Preparing for the Transition

GitHub has initiated a phased rollout of these changes, with partial implementations already present in npm versions 11.10.0 through 11.16.0, which include warning mechanisms. GitHub strongly recommends that developers upgrade to npm 11.16.0 or later. By running a standard installation process with these versions, developers can identify potential disruptions to their existing workflows and begin adapting to the new opt-in security model.

This strategic shift by GitHub reflects a broader industry-wide commitment to securing the open-source software supply chain, which has become a frequent target for sophisticated attacks, including typosquatting, dependency confusion, and the injection of malicious package updates. By mandating explicit trust declarations for script execution and external sources, npm v12 effectively implements a zero-trust model for dependency installation, thereby minimizing the risk of silent compromises during routine development operations.

Organizations heavily reliant on third-party packages will need to adjust their CI/CD pipelines and dependency management practices. However, this adjustment represents a necessary trade-off for a more secure and transparent software development lifecycle, aligning with modern secure-by-default principles.

What You Should Do

• Upgrade to npm version 11.16.0 or later immediately to begin identifying and addressing potential compatibility issues in your current projects.
• Run your standard npm install processes with the updated npm version to observe warnings about blocked behaviors.
• Utilize npm approve-scripts --allow-scripts-pending to preview scripts that will be blocked in npm v12.
• Begin allowlisting trusted packages using npm approve-scripts and commit the updated package.json to version control.
• Review and update CI/CD pipelines to account for the new default behaviors regarding script execution and external Git/remote dependencies.
• Educate development teams on the new security features and the requirement for explicit approvals for scripts and non-registry dependencies.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.