GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks
GitHub will ship npm 12 with install scripts off by default to reduce supply chain abuse. Developers will need to explicitly approve trusted scripts and other risky dependency sources.
Intelligence analysis by GPT-5.4 Mini
GitHub says npm 12 will make script execution opt-in by default, limiting a major code-execution path in package installs. The move targets malicious lifecycle hooks, git dependencies, and remote URL installs that can run code on developer machines or CI runners.
GitHub is changing npm so packages cannot secretly run code when they are installed unless someone says it is okay. It is like a delivery box that no longer opens itself and starts pressing buttons inside the house.
Analysis
What GitHub is changing
GitHub says npm 12 will introduce breaking changes that disable install scripts by default. That means preinstall, install, and postinstall scripts from dependencies will not run unless they are explicitly allowed in the project.
The company frames install-time lifecycle scripts as the largest code-execution surface in the npm ecosystem. The reason is simple: a normal npm install can pull in many transitive dependencies, and a single compromised package anywhere in that tree can execute arbitrary code on a developer machine or CI runner.
Other default restrictions
The new defaults also tighten how npm resolves dependencies. Git dependencies will not be resolved unless allowed with --allow-git, and remote URL dependencies, including HTTPS tarballs, will not be resolved unless allowed with --allow-remote.
GitHub says this also covers native node-gyp builds, since npm can implicitly trigger a rebuild even when a package has no explicit install script. It adds that prepare scripts from git, file, and link dependencies are blocked the same way.
What developers are supposed to do
GitHub recommends upgrading to npm 11.16.0 or newer, running a normal install, and reviewing the warnings. Developers can then use npm approve-scripts --allow-scripts-pending to review packages with scripts, approve the ones they trust, and commit the updated package.json.
The broader direction is clear: make code execution during dependency installation something a developer chooses, not something npm trusts by default. GitHub also points to an earlier safeguard, min-release-age, which rejects package versions that are too newly published, as another defense against malicious uploads.
Key points
- npm 12 will disable dependency install scripts by default unless they are explicitly approved.
- Git dependencies and remote URL dependencies will also require explicit allowance.
- GitHub says install-time lifecycle scripts are a major code-execution risk in npm.
- Developers are told to upgrade to npm 11.16.0 or newer and review script warnings.
- npm already added `min-release-age` earlier this year as another anti-abuse control.
If developers review and approve scripts carefully, the change could cut down on supply chain attacks that rely on hidden install-time code. It also gives teams clearer control over which packages are allowed to run code during installs. The added checks may push the ecosystem toward safer dependency habits, especially in CI and other automated environments where one bad package can cause a lot of damage.
The changes are breaking by design, so some projects may hit installation failures or need extra work to approve trusted packages. Teams that rely on implicit install behavior may see short-term friction. Attackers may also shift to other package trust paths, such as convincing developers to approve malicious scripts or finding new ways around dependency controls.
