npm 12 disabling dependency install scripts by default is an important security change for the JavaScript software supply chain.

For years, npm packages could run preinstall, install, and postinstall scripts automatically when developers or build systems installed dependencies. Attackers abused this behavior through malicious packages, typosquatting, dependency confusion, and compromised maintainer accounts to steal tokens, environment variables, SSH keys, cloud credentials, and CI/CD secrets.

With npm 12, these scripts will no longer run by default unless explicitly allowed by the project. This reduces the risk that simply installing a dependency will execute attacker-controlled code. Git-based dependencies, remote URL dependencies, and native builds using node-gyp are also affected by the stricter behavior.

This is a positive change, but it is not a complete solution. Developers and DevOps teams will still need to review which packages are allowed to run scripts, document exceptions, and avoid blindly approving build steps just to make errors disappear. Because naturally, the fastest way to defeat a security control is to click “allow” until the build turns green.

Organizations should review their npm dependency policies, update CI/CD pipelines, test builds with npm 12, and create an approval process for packages that genuinely require install scripts. Secrets should be minimized in build environments, and package activity should be monitored for unusual behavior.

The key lesson is that software installation should not automatically mean code execution. npm 12 moves the ecosystem toward safer defaults, but the real protection depends on disciplined approvals, dependency review, and secure build environments.

GitHub has officially announced the release of npm version 12 with install scripts disabled by default, along with deprecating granular access tokens (GATs) designed to bypass two-factor authentication (2FA). The Microsoft-owned subsidiary noted that the following npm install behaviors that used to run automatically before have been made opt-in - allowScripts defaults to off, meaning

Source: npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk via The Hacker News — published 09 Jul 2026.