Npm v12 Will Stop Automatic Script Execution by Default
The change removes a longstanding default behavior in npm that made package installation a potential attack surface, shifting the burden of trust from the package ecosystem to the developer's explicit approval.
Key Facts
- npm v12, due in July 2026, will disable automatic execution of install scripts by default.
- The change closes a security vector where malicious packages could run arbitrary code during installation.
- Developers must explicitly approve scripts for trusted packages using npm approve-scripts and npm deny-scripts.
- Git and remote URL dependencies will also be blocked by default in npm v12.
- Starting with npm 11.16.0, warnings will appear for packages whose scripts will be restricted in v12.
Reporting from 1 source: GIGAZINE.
GitHub announced that npm v12, due in July 2026, will disable automatic execution of install scripts by default. The change is intended to close a security vector where malicious packages could run arbitrary code during installation. Developers will need to explicitly approve scripts for trusted packages, and Git and remote URL dependencies will also be blocked by default.
GitHub plans to ship npm v12 in July 2026 with a major security change: the package manager will no longer run install scripts automatically. In current versions, packages can include preinstall, install, and postinstall scripts that execute without developer review, a mechanism that has been exploited by compromised packages. Under the new default, the allowScripts setting will be off, and scripts will run only for packages explicitly trusted by the project. The implicit node-gyp rebuild for native addons will also be blocked without permission.
Git and remote URL dependencies will be disabled by default as well, closing another path for arbitrary code execution via .npmrc file rewriting. Starting with npm 11.16.0, warnings will appear for packages whose scripts will be restricted in v12. Developers can use npm approve-scripts and npm deny-scripts to manage trust, with the allow/deny list stored in package.json for team sharing.
Synthesized by Yomimono from the 1 cited source below, including Japanese-language reporting where cited, then editorially reviewed before publishing.