npm v12's Biggest Security Change: Installation Scripts Now Need Your Permission

npm has been running on implicit trust for over a decade: install a package, and whatever installation scripts the package author included run automatically. npm v12, shipping July 2026, ends that assumption. Installation scripts now require explicit developer approval — and the consequences for CI/CD pipelines that haven’t been audited are significant.

What Happened

npm v12 introduces three changes that together constitute a fundamental shift from implicit to explicit trust in package installation:

allowScripts — Lifecycle scripts (preinstall, postinstall, and similar hooks) are now disabled by default. Previously, these ran automatically on installation, giving malicious packages a reliable execution window. According to JFrog’s analysis, this mechanism was exploited in approximately 46% of recent malware campaigns. To run lifecycle scripts, teams must explicitly approve specific packages.

—allow-git — npm previously fetched and installed code from GitHub URLs in dependency trees automatically, including transitive Git dependencies that developers often don’t inspect directly. npm v12 blocks this by default. Attackers who hide payloads outside the registry in Git repositories lose a reliable delivery channel.

—allow-remote — Dependencies resolved from HTTPS URLs (remote tarballs, attacker-controlled servers) are disabled by default. This closes the Remote Dynamic Dependencies technique used in recent campaigns where the malicious payload wasn’t present in the registry at all, but fetched at install time from an external server.

JFrog researchers estimate that across the last year, 53% of malicious npm attacks relied on installation-time script execution — the mechanism that allowScripts now blocks by default.

Why It Matters

The npm supply chain security challenge has been persistent precisely because the attack surface was structural: implicit execution on install gave attackers a guaranteed code execution window that existed independent of how carefully developers reviewed package code. npm v12 removes that guarantee.

The attack campaigns JFrog names — Shai-Hulud, CanisterWorm, and easy-day-js — relied on installation-time execution to steal credentials and compromise CI/CD pipelines. The new default blocks the vector, not just the specific payload. Teams that upgrade to npm v12 will face an explicit breaking change if any of their dependencies use restricted mechanisms without approval. That friction is the feature, not the bug.

JFrog researchers note that attackers will likely pivot toward runtime execution — code that activates when packages are imported or functions are called — which npm v12 does not restrict. The defense is not complete, but it eliminates one of the most reliable attack paths in the npm ecosystem.

What This Means for Builders

Three immediate actions for enterprise teams:

1. Audit CI/CD pipelines before upgrading. Installation steps that previously ran automatically may now fail. Identify which dependencies use postinstall scripts and evaluate whether they require explicit approval or should be replaced.

2. Treat approvals as version-pinned. Grant allowScripts approval for specific versions, not packages wholesale. Re-evaluate approvals during dependency upgrades.

3. Continue scanning. npm v12’s changes address installation-time execution, not runtime execution. Ongoing artifact scanning and curation for packages already in your dependency graph remains necessary.

Source: JFrog

Content created with AI assistance and reviewed for accuracy.