In response to recent supply chain attacks abusing automatic script execution during npm install, GitHub announced that NPM 12 will disable execution of preinstall, install, and postinstall scripts from dependencies by default. This change also affects native node-gyp builds and prepare scripts from git, file, and link dependencies. Git and remote URL dependencies will no longer be resolved automatically unless explicitly allowed. Developers can use npm approve-scripts to create an allowlist of trusted scripts, which is stored in package.json. This mitigates attack vectors exploited by malware such as the Shai-Hulud worm and TeamPCP incidents.

The change reduces the risk of supply chain attacks that rely on executing malicious scripts during npm install, which previously infected thousands of developers. By blocking script execution by default, it prevents automatic execution of potentially harmful code embedded in dependencies. However, it may require developers to explicitly approve scripts needed for legitimate builds, potentially impacting some workflows until adjusted.

Upgrade to NPM version 11.16.0 or later to receive warnings about script execution during install. Use the npm approve-scripts command to review and explicitly allow trusted scripts, committing the resulting allowlist to package.json. When upgrading to NPM 12, only approved scripts will run by default, blocking untrusted ones. No urgent action is required beyond upgrading and managing script approvals, as this change is a security improvement to prevent supply chain attacks.