NewsPublished 13 Jun 2026

NPM 12 Will Change Script Execution Behavior to Prevent Supply Chain Attacks

Source SecurityWeek

Description

By default, npm install will no longer execute scripts from dependencies, unless explicitly allowed. The post NPM 12 Will Change Script Execution Behavior to Prevent Supply Chain Attacks appeared first on SecurityWeek .

Impact

The change reduces the risk of supply chain attacks that rely on executing malicious scripts during npm install, which previously infected thousands of developers. By blocking script execution by default, it prevents automatic execution of potentially harmful code embedded in dependencies. However, it may require developers to explicitly approve scripts needed for legitimate builds, potentially impacting some workflows until adjusted.

Defensive guidance

Upgrade to NPM version 11.16.0 or later to receive warnings about script execution during install. Use the npm approve-scripts command to review and explicitly allow trusted scripts, committing the resulting allowlist to package.json. When upgrading to NPM 12, only approved scripts will run by default, blocking untrusted ones. No urgent action is required beyond upgrading and managing script approvals, as this change is a security improvement to prevent supply chain attacks.

References

securityweek.com/npm-12-will-change-script-execution-behavior-to-prevent-supply-chain-attacks/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 13 Jun 2026, 15:54 UTC

References

Community reviews