NewsPublished 10 Jun 2026

GitHub announces npm security changes to tackle supply-chain attacks

Source Bleeping Computer

Description

GitHub has announced that npm v12, expected next month, will introduce several security-focused changes aimed at blocking supply-chain attacks abusing behaviors triggered by the 'npm install' command. [...]

Impact

The changes in npm v12 reduce the risk of supply-chain attacks by disabling automatic execution of install scripts and automatic fetching of dependencies from Git and remote URLs without explicit approval. This mitigates attack vectors used in recent campaigns involving malicious install scripts and Git dependency abuse. However, projects relying on these behaviors for legitimate purposes will need to explicitly opt in, potentially requiring workflow adjustments.

Defensive guidance

GitHub recommends upgrading to npm version 11.16.0 or newer to receive warnings about behaviors that will be blocked in npm v12. This allows developers to identify dependencies and workflows needing explicit approval before upgrading. After upgrading to npm v12, only explicitly approved install scripts and dependency sources will run automatically. Developers should review and approve necessary scripts and dependency sources to maintain functionality while benefiting from enhanced security.

Summary

GitHub plans to release npm v12 with security enhancements that block supply-chain attacks exploiting automatic behaviors during 'npm install'. Specifically, npm v12 will not run preinstall, install, or postinstall scripts from dependencies unless explicitly approved, including native module builds and prepare scripts from Git, local file, and linked dependencies. Additionally, npm install will no longer fetch dependencies from Git repositories or remote URLs unless explicitly permitted. These changes remove automatic code execution paths and dependency resolutions that have been abused in recent supply-chain attacks. Developers are advised to upgrade to npm 11.16.0 or later to receive warnings about actions that will break under npm v12 and prepare accordingly.

References

bleepingcomputer.com/news/security/github-announces-npm-security-changes-to-tackle-supply-chain-attacks/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 Jun 2026, 19:44 UTC

References

Community reviews