GitHub to Automatically Disable npm Script Installs Against Attacks

GitHub has announced a security-focused overhaul of npm with the upcoming release of npm v12, introducing stricter default controls designed to mitigate software supply chain attacks and prevent unauthorized code execution during package installation.

The changes, currently available as opt-in warnings in npm version 11.16.0 and later, are expected to become the default behavior when npm v12 is released in July 2026.

At the core of this update is a fundamental shift in how npm handles install-time scripts, a long-standing attack vector frequently abused by threat actors to execute malicious code.

GitHub to Disable npm Script Installs

In npm v12, the allowScripts configuration will be turned off by default, meaning lifecycle scripts such as preinstall, install, and postinstall will no longer run automatically for dependencies unless explicitly approved by developers.

This change also impacts implicit script execution, including native module builds powered by node-gyp, which will now be blocked unless permitted.

Additionally, npm will restrict the execution of prepare scripts from Git, local files, and linked dependencies under the same policy.

Developers can audit affected packages using the npm approve-scripts --allow-scripts-pending command, which identifies dependencies attempting to run scripts.

Trusted packages can then be explicitly allowlisted using npm approve-scripts, while untrusted ones can be blocked with npm deny-scripts.

The resulting policy is stored within the package.json file, enabling version-controlled enforcement across development environments.

Another significant change involves Git-based dependencies. The --allow-git flag will default to none, preventing npm from resolving Git dependencies unless explicitly enabled.

This measure addresses a previously identified risk where malicious .npmrc configurations within Git repositories could override the Git executable path, enabling arbitrary command execution even when script execution was disabled via --ignore-scripts.

Similarly, npm v12 introduces a default restriction on remote dependency sources via the --allow-remote flag, which also defaults to none.

This prevents installations from remote tarball URLs unless explicitly authorized, further reducing exposure to unverified or tampered packages delivered outside the official registry, as published on GitHub.

Notably, related flags such as --allow-file and --allow-directory will retain their current behavior, keeping local workflows stable while tightening only higher-risk remote and Git-based paths.

To prepare for these breaking changes, GitHub recommends upgrading to npm 11.16.0 or later and running standard installation workflows to surface warnings.

Developers should review flagged packages, approve trusted scripts, and commit the updated configuration to ensure a smooth transition. Once npm v12 is adopted, only explicitly approved scripts will execute, effectively eliminating implicit trust in dependency behavior.

These changes reflect GitHub’s broader push toward strengthening supply chain security within the JavaScript ecosystem.

By shifting from implicit execution to explicit trust, npm v12 aims to significantly reduce the risk of dependency-based attacks, which have increasingly targeted developers through malicious packages, compromised maintainers, and obfuscated install scripts.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.

The post GitHub to Automatically Disable npm Script Installs Against Attacks appeared first on Cyber Security News.