npm 12 Disables Install Scripts by Default to Mitigate Supply Chain Risks
npm version 12 introduces significant security enhancements by disabling install scripts by default and deprecating granular access tokens that bypass two-factor authentication.
GitHub has rolled out npm version 12, a release heavily focused on bolstering supply chain security within the JavaScript ecosystem. The most prominent change is the default disabling of install scripts, a move designed to curb the potential for malicious code execution during package installation. Previously, scripts like preinstall, install, and postinstall, as well as implicit node-gyp builds, would run automatically. Now, these actions are opt-in, requiring explicit user approval to prevent unexpected or harmful code from executing.
To manage these approved scripts, users must now run npm approve-scripts --allow-scripts-pending and commit the resulting allowlist to their package.json file. This new workflow ensures that developers are aware of and consent to any scripts that will run as part of their dependencies. Furthermore, the resolution of Git dependencies and dependencies from remote URLs are also now opt-in behaviors, defaulting to 'none' unless explicitly permitted by the user. This granular control aims to reduce the attack surface by preventing the automatic fetching and execution of code from untrusted sources.
Beyond install scripts, npm 12 also addresses security concerns related to authentication tokens. Granular Access Tokens (GATs) that were designed to bypass two-factor authentication (2FA) are being deprecated. Specifically, these tokens will no longer be able to perform sensitive account, package, and organization management actions. This includes critical operations such as creating or deleting tokens, changing account passwords or 2FA configurations, modifying package maintainers, and managing organization memberships. The deprecation of these bypass tokens is a significant step towards enforcing stronger authentication practices.
Further restrictions are being placed on the publishing capabilities of GATs. While they will retain the ability to read private packages and stage a publish, they will no longer be able to publish directly. A package will only become public after a human 2FA approval step. This change is slated to take effect in January 2027. GitHub advises developers to transition their automated publishing workflows to more secure methods like trusted publishing using OpenID Connect (OIDC) or staged publishing with human oversight, rather than relying on long-lived publish tokens.
These changes follow a preview period where developers were encouraged to upgrade to npm 11.16.0 or newer and review warnings displayed during installations. The proactive approach aims to give the developer community time to adapt to the new security paradigms. The move by npm aligns with broader industry trends toward enhancing software supply chain security, recognizing that compromised dependencies can have far-reaching consequences.
In related developments, pnpm 11.10 has introduced a new _auth setting for registry authentication. This feature consolidates credentials with their associated hosts, preventing malicious or compromised project files (like pnpm-workspace.yaml or .npmrc) from redirecting valid tokens to different hosts. This measure directly addresses a common attack vector where attackers attempt to steal registry tokens by tampering with project configuration files.
The cumulative effect of these updates in npm 12 and related package managers is a significant hardening of the development environment against supply chain attacks. By making potentially risky operations opt-in and deprecating bypass mechanisms, npm is prioritizing developer and end-user security, making it more difficult for malicious actors to inject compromised code into the software development lifecycle.