npm 12 disables postinstall scripts by default to enhance security

npm has released version 12, introducing significant security changes to the Node.js package manager. The most critical update is that lifecycle scripts—including preinstall, install, and postinstall—are now disabled by default. Developers must now explicitly allow these scripts to run, a move designed to mitigate software supply chain attacks where malicious code is executed automatically during package installation.

In addition to script restrictions, npm 12 deprecates fine-grained access tokens that could bypass two-factor authentication. It also sets --allow-git and --allow-remote to 'none' by default to close potential code execution paths via Git dependencies and HTTPS tarballs.

While the security community generally supports the move, experts from Checkmarx warn of potential side effects. There is a concern regarding 'approval fatigue,' where developers might reflexively approve scripts without proper review, potentially neutralizing the security benefits. Furthermore, security researchers suggest that attackers may shift their tactics from installation-time scripts to runtime-based attacks, targeting the code that executes once a package is already running in an environment.