GitHub to disable automatic npm scripts in v12 to curb supply‑chain attacks

GitHub announced that the upcoming npm version 12 will change default behavior to improve software‑supply‑chain security. The update will turn off automatic execution of pre‑install, install and post‑install scripts, as well as native module builds triggered by node‑gyp, unless developers explicitly approve them through a new allowScripts setting. npm v12 will also block automatic fetching of dependencies from Git repositories and remote URLs (e.g., HTTPS tarballs) unless the allow‑git and allow‑remote options are enabled. Developers can preview blocked actions with the command npm approve‑scripts and can whitelist trusted scripts via npm approve‑scripts or block untrusted ones with npm deny‑scripts. GitHub recommends upgrading to npm 11.16.0 or later to see warnings about potential disruptions before moving to v12. The changes aim to eliminate common attack vectors used in recent supply‑chain compromises and will require adjustments to CI/CD pipelines and dependency‑management practices.

These defaults are part of a broader industry effort to secure open‑source ecosystems against tactics such as typosquatting, dependency confusion and malicious package updates.