GitHub Will Disable npm Install Scripts by Default to Reduce Supply Chain Attacks

GitHub is preparing a major npm security change that will stop dependency install scripts from running automatically by default. The change is coming in npm v12, which is estimated for release in July 2026, according to the official GitHub Changelog.

The update means that npm install will no longer run preinstall, install, or postinstall scripts from dependencies unless a project explicitly approves them. GitHub says the goal is to turn risky automatic behavior into an opt-in action that developers and security teams can review first.

This matters because install scripts can execute code during package installation. Attackers have abused that behavior in malicious npm packages, dependency confusion attacks, typosquatting campaigns, and compromised package updates.

What Changes in npm v12

The biggest change is the new default behavior for allowScripts. In npm v12, install scripts from dependencies will stay blocked unless the project allowlists trusted packages. This also covers implicit native builds triggered through node-gyp when a package contains a binding.gyp file.

GitHub says prepare scripts from Git, file, and linked dependencies will also follow the same blocked-by-default model. The company describes the npm v12 update as a security-related breaking change because some existing installs and CI workflows may fail until teams approve the packages they trust.

Developers can start preparing now. GitHub says the upcoming behavior already appears as warnings in npm 11.16.0 or newer, giving teams time to find packages that rely on install-time scripts before npm v12 changes the default.

npm v12 change	New default	Impact
Dependency install scripts	Blocked unless approved	preinstall, install, postinstall, and some prepare scripts will not run automatically
Native node-gyp builds	Blocked unless approved	Native modules may need explicit approval before they build
Git dependencies	Blocked unless allowed	Git-based dependencies will require allow-git approval
Remote URL dependencies	Blocked unless allowed	HTTPS tarballs and similar remote sources will require allow-remote approval

Developers Must Approve Trusted Scripts

npm now provides commands to help teams review scripts before approving them. The npm approve-scripts command manages the allowScripts field in package.json, which records the dependencies that can run install scripts.

Teams can preview packages that still need review by running npm approve-scripts with the allow-scripts-pending option. After review, trusted packages can be approved, while packages that should never run scripts can be blocked with npm deny-scripts.

The approved script list belongs in package.json and should be committed to version control. That gives teams a shared policy instead of relying on each developer’s local npm settings.

• Upgrade to npm 11.16.0 or newer.
• Run a normal install and review script-related warnings.
• Use npm approve-scripts –allow-scripts-pending to list packages that need review.
• Approve trusted packages after checking why they need install scripts.
• Deny packages that should not run install-time code.
• Commit the updated package.json file.

Git and Remote Dependencies Face Stricter Controls

npm v12 will also tighten rules for non-registry dependencies. The allow-git option will default to none, meaning npm install will not resolve direct or transitive Git dependencies unless developers explicitly allow them.

GitHub previously warned that Git dependencies can include .npmrc files that override the Git executable path. The earlier npm script security update said this could allow code execution during install even when ignore-scripts is used.

The allow-remote option will also default to none. As a result, npm install will block dependencies from remote URLs, including HTTPS tarballs, unless a developer or organization explicitly permits them.

Source type	npm v12 behavior	Why it matters
npm registry package	Installs normally, but scripts need approval	Reduces automatic code execution from dependencies
Git dependency	Blocked unless allow-git permits it	Limits hidden Git-based install risks
Remote tarball	Blocked unless allow-remote permits it	Stops unexpected package sources from entering builds
File and directory sources	No default change for allow-file or allow-directory	Local dependency behavior remains unchanged by this part of npm v12

Why GitHub Is Changing npm Install Defaults

The change reflects a broader move toward secure-by-default package management. Install scripts have legitimate uses, especially for native modules and build tooling, but they also create an easy execution path for malicious packages.

For attackers, install scripts are attractive because developers and CI systems often run npm install automatically. A compromised dependency can execute code before anyone imports the package in an application.

By making script execution opt-in, npm v12 forces projects to record trust decisions. The allow-scripts config also supports one-off and global contexts such as npx, npm exec, and npm install -g, where a project package.json may not exist.

• Malicious packages can abuse lifecycle scripts during installation.
• Native build tools may run code before developers inspect package behavior.
• Git dependencies can introduce hidden configuration risks.
• Remote tarballs can bypass normal registry-based expectations.
• CI/CD pipelines often run installs automatically, increasing the impact of unsafe defaults.

Teams Should Test CI/CD Pipelines Before npm v12

The upcoming change could break builds that rely on dependency install scripts without documenting that trust. Packages such as image processing libraries, native modules, and build helpers may require approval before they keep working under npm v12.

Organizations should test npm 11.16.0 or newer in development and CI environments. The second mention of the npm v12 changelog makes clear that unapproved scripts will stop once the major upgrade lands.

Security teams should treat the migration as a chance to audit dependency behavior. Any package that wants install-time execution should have a clear reason, a trusted maintainer history, and a version policy that fits the organization’s risk level.

Team	Recommended action
Developers	Run npm approve-scripts –allow-scripts-pending and review packages that use install scripts
Security teams	Define approval rules for scripts, Git dependencies, and remote URL dependencies
DevOps teams	Test npm 11.16.0 warnings in CI before npm v12 reaches production builds
Maintainers	Document why packages need install scripts and reduce unnecessary lifecycle hooks

How to Prepare for the npm v12 Migration

Developers should use npm approve-scripts documentation to understand how approvals work and how pinned entries are written. By default, approvals can track the reviewed package version, which helps avoid silently approving future versions without review.

Teams should also use the npm deny-scripts documentation for packages that should remain blocked. Deny entries write false values into allowScripts, recording that a dependency must not run install scripts even if it would otherwise become eligible.

For global installs and one-off commands, teams should check the npm config documentation. The command-line allow-scripts setting works differently outside project-scoped installs, so organizations should not assume one policy covers every npm use case.

The same security direction also appears in GitHub’s earlier trusted publishing and script security update, which encouraged developers to use stricter install controls before npm v12. The latest changes now make those controls part of the default security posture for the next major npm release.

FAQ