GitHub announces npm security changes to tackle supply-chain attacks
GitHub says npm v12 will require explicit approval for several install-time behaviors that attackers often abuse in supply-chain attacks.
Intelligence analysis by GPT-5.4 Mini
GitHub is tightening npm’s defaults in version 12 to make risky install-time actions opt-in instead of automatic. The changes target script execution and dependency sources that have been used in recent package supply-chain attacks.
GitHub is changing npm so it stops automatically opening every door during app setup. It wants people to say “yes” first before letting packages run extra code or fetch files from risky places, like adding a lock instead of leaving the door open.
Analysis
What changes
GitHub says npm v12, expected next month, will stop trusting several behaviors by default during npm install. Dependency lifecycle scripts such as preinstall, install, and postinstall will no longer run unless they are explicitly approved. The same opt-in requirement will also apply to native module builds triggered through node-gyp, and to prepare scripts used by Git, local file, and linked dependencies.
The company is also changing how dependencies are resolved. npm install will no longer fetch packages from Git repositories unless explicitly allowed, whether the dependency is direct or transitive. Remote URL dependencies, including HTTPS tarballs, will also require explicit permission before they can be resolved.
Why GitHub is doing this
The article frames these defaults as a response to supply-chain attacks that abuse install-time execution. GitHub says the goal is to remove automatic code execution and automatic fetching from non-registry sources unless a developer has intentionally approved it.
The story points to several recent attack styles that could be affected, including malicious script campaigns against eslint-config-prettier, Toptal's Picasso packages, multiple data-stealing npm packages, and Git dependency abuse described in Shai-Hulud attacks.
What developers should do
GitHub recommends upgrading first to npm 11.16.0 or newer. That version will warn when a workflow uses something that will break under npm 12, giving teams time to identify dependencies and build steps that need explicit approval. Projects that rely on these behaviors for legitimate reasons will need to opt in before moving to npm v12.
Key points
- npm v12 will require explicit approval for several install-time behaviors by default.
- `preinstall`, `install`, `postinstall`, and some `prepare` scripts will no longer run automatically.
- Git-based and remote URL dependencies will also need explicit permission.
- GitHub says npm 11.16.0+ will warn about actions that will break under v12.
- The goal is to reduce supply-chain attacks that rely on automatic code execution during install.
If the changes work as intended, they could block many package-install attacks before code ever runs. Developers also get a warning period in npm 11.16.0+, which should make it easier to find workflows that need approval before the stricter defaults arrive.
Teams that depend on install scripts, Git-based dependencies, or remote tarballs may see build failures or slowed migrations when they move to npm v12. Attackers may also shift to other paths that still remain allowed, so the change reduces risk without eliminating it.
