GitHub plans to release npm v12 with security enhancements that block supply-chain attacks exploiting automatic behaviors during 'npm install'. Specifically, npm v12 will not run preinstall, install, or postinstall scripts from dependencies unless explicitly approved, including native module builds and prepare scripts from Git, local file, and linked dependencies. Additionally, npm install will no longer fetch dependencies from Git repositories or remote URLs unless explicitly permitted. These changes remove automatic code execution paths and dependency resolutions that have been abused in recent supply-chain attacks. Developers are advised to upgrade to npm 11.16.0 or later to receive warnings about actions that will break under npm v12 and prepare accordingly.

The changes in npm v12 reduce the risk of supply-chain attacks by disabling automatic execution of install scripts and automatic fetching of dependencies from Git and remote URLs without explicit approval. This mitigates attack vectors used in recent campaigns involving malicious install scripts and Git dependency abuse. However, projects relying on these behaviors for legitimate purposes will need to explicitly opt in, potentially requiring workflow adjustments.

GitHub recommends upgrading to npm version 11.16.0 or newer to receive warnings about behaviors that will be blocked in npm v12. This allows developers to identify dependencies and workflows needing explicit approval before upgrading. After upgrading to npm v12, only explicitly approved install scripts and dependency sources will run automatically. Developers should review and approve necessary scripts and dependency sources to maintain functionality while benefiting from enhanced security.