--- title: Finally some good news | daily.dev description: npm version 12 introduces a major security improvement by disabling post-install scripts by default, requiring explicit opt-in via an 'allow scripts' flag.... canonical: https://daily.dev/posts/finally-some-good-news-kn0ganalv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Finally some good news | daily.dev og:description: npm version 12 introduces a major security improvement by disabling post-install scripts by default, requiring explicit opt-in via an 'allow scripts' flag.... og:url: https://daily.dev/posts/finally-some-good-news-kn0ganalv og:image: https://api.daily.dev/og/posts/kn0GaNAlV.png og:image:alt: Finally some good news og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Finally some good news **[Low Level Learning](https://daily.dev/sources/lowlevellearning)** · 10 min read · 70 upvotes · 5 comments ## Summary npm version 12 introduces a major security improvement by disabling post-install scripts by default, requiring explicit opt-in via an 'allow scripts' flag. This directly addresses the Shyholude worm campaigns that have been compromising the npm ecosystem by using malicious post-install scripts to steal credentials, cloud tokens, and CI/CD pipeline access tokens. Additional new defaults include disabling git binary overrides and blocking remote URL dependency resolution. The video also recommends using npm's minimum release age setting to avoid newly published malicious packages, since most supply chain compromises are caught within days or weeks of publication. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Will npm 12 run postinstall scripts by default like older npm versions did? No, npm 12 will turn off automatic execution of preinstall, install, and postinstall scripts by default, requiring an explicit allow-scripts opt-in. This and two related flags, allow-git (defaults to none) and allow-remote (blocks resolving dependencies from remote URLs like HTTPS tarballs unless allowed), are already available behind warnings in npm 11.15 and 11.16 ahead of becoming npm 12 defaults. _Track npm's script-execution defaults on daily.dev before upgrading pipelines that rely on postinstall hooks._ ### How does the Shai-Hulud npm worm spread through dependencies? Shai-Hulud spreads by exploiting npm's postinstall script feature, a shell script that runs automatically when a package or any of its transitive dependencies is installed. Once triggered, it steals credentials such as AWS, GCP, and Azure tokens plus npm publish and OIDC tokens, then uses them to publish more malicious packages, propagating further across the ecosystem since at least October of last year. _Developers auditing dependency trees for postinstall risk can follow supply chain security coverage on daily.dev._ ### What is npm's minimum release age setting and why would I enable it? Minimum release age is an npm setting that blocks installation of packages younger than a specified number of days or weeks. It helps because most recent npm supply chain compromises were detected within one to two days, some in as little as 90 minutes, so delaying adoption of brand-new package versions reduces exposure to freshly published malicious releases. _Teams weighing dependency update policies can keep up with npm security settings via daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@joashua** · 7 upvotes > Well, looks like hackers will have to find a real job, now. **@mavros\_lykos** · 3 upvotes > funny thing is some mf will also try to exploit that too.. **@kibongo** · 2 upvotes > Cybersecurity guys have a lot of work to do nowadays. This year is the first where internet has never felt safe ever. > I had to do a whole server reset back in November 2025, that's when I knew we are doomed ## Similar posts on daily.dev - [npm v12’s Biggest Security Change: From Implicit to Explicit Trust](https://daily.dev/posts/npm-v12-s-biggest-security-change-from-implicit-to-explicit-trust-2d4pdcf9o) · JFrog · 0 upvotes · 0 comments - [GitHub announces npm security changes to tackle supply-chain attacks](https://daily.dev/posts/github-announces-npm-security-changes-to-tackle-supply-chain-attacks-utlkr6lo8) · BleepingComputer · 0 upvotes · 0 comments - [npm v12 delivers one of the biggest security improvements in years](https://daily.dev/posts/npm-v12-delivers-one-of-the-biggest-security-improvements-in-years-v9aauccwh) · Aikido Security · 69 upvotes · 3 comments --- Tags: [#security](https://daily.dev/tags/security), [#javascript](https://daily.dev/tags/javascript), [#cicd](https://daily.dev/tags/cicd), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/finally-some-good-news-kn0ganalv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Finally some good news","url":"https://daily.dev/posts/finally-some-good-news-kn0ganalv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/finally-some-good-news-kn0ganalv"},"datePublished":"2026-06-17T16:40:10.426Z","dateModified":"2026-09-14T07:45:49.158Z","description":"npm version 12 introduces a major security improvement by disabling post-install scripts by default, requiring explicit opt-in via an 'allow scripts' flag....","image":"https://i.ytimg.com/vi/cX3G0cPRJiA/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/cX3G0cPRJiA/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Low Level Learning","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Low Level Learning","logo":"https://media.daily.dev/image/upload/s--pjLyMMmx--/f_auto/v1724394406/logos/lowlevellearning","url":"https://daily.dev/sources/lowlevellearning"},"commentCount":5,"discussionUrl":"https://daily.dev/posts/finally-some-good-news-kn0ganalv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":70},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":5}],"keywords":"security,javascript,cicd,malware,npm","timeRequired":"PT10M","video":{"@type":"VideoObject","name":"Finally some good news","description":"npm version 12 introduces a major security improvement by disabling post-install scripts by default, requiring explicit opt-in via an 'allow scripts' flag....","thumbnailUrl":"https://i.ytimg.com/vi/cX3G0cPRJiA/sddefault.jpg","uploadDate":"2026-06-17T16:40:10.426Z","duration":"PT10M","url":"https://api.daily.dev/r/kn0GaNAlV","embedUrl":"https://www.youtube.com/embed/cX3G0cPRJiA"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Low Level Learning","item":"https://daily.dev/sources/lowlevellearning"},{"@type":"ListItem","position":3,"name":"Finally some good news"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/finally-some-good-news-kn0ganalv","comment":[{"@type":"Comment","text":"Well, looks like hackers will have to find a real job, now.","datePublished":"2026-06-18T11:46:46.365Z","url":"https://daily.dev/posts/kn0GaNAlV#c-WwkrtC7ae","author":{"@type":"Person","name":"Joashua","url":"https://daily.dev/joashua","image":"https://media.daily.dev/image/upload/s--O0TOmw4y--/f_auto/v1715772965/public/noProfile"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":7}},{"@type":"Comment","text":"funny thing is some mf will also try to exploit that too…","datePublished":"2026-06-19T09:20:53.093Z","url":"https://daily.dev/posts/kn0GaNAlV#c-wuZJxkTBZ","author":{"@type":"Person","name":"Charaka Hashan","url":"https://daily.dev/mavros_lykos","image":"https://media.daily.dev/image/upload/s--UhlNgzLT--/f_auto/v1786970273/avatars/avatar_rP15vFIdEPNpDSYMOi2AR?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3}},{"@type":"Comment","text":"Cybersecurity guys have a lot of work to do nowadays. This year is the first where internet has never felt safe ever.\nI had to do a whole server reset back in November 2025, that’s when I knew we are doomed","datePublished":"2026-06-19T10:31:53.241Z","url":"https://daily.dev/posts/kn0GaNAlV#c-fTC9FHR7c","author":{"@type":"Person","name":"KIBONGO Simon Peter","url":"https://daily.dev/kibongo","image":"https://lh3.googleusercontent.com/a/ACg8ocLXNKVhVIvovYerRL1paJ7Y9hhXP4lDsb9Or0VvdeeVGTfL9sx-KQ=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/finally-some-good-news-kn0ganalv#faq","mainEntity":[{"@type":"Question","name":"Will npm 12 run postinstall scripts by default like older npm versions did?","acceptedAnswer":{"@type":"Answer","text":"No, npm 12 will turn off automatic execution of preinstall, install, and postinstall scripts by default, requiring an explicit allow-scripts opt-in. This and two related flags, allow-git (defaults to none) and allow-remote (blocks resolving dependencies from remote URLs like HTTPS tarballs unless allowed), are already available behind warnings in npm 11.15 and 11.16 ahead of becoming npm 12 defaults. Track npm's script-execution defaults on daily.dev before upgrading pipelines that rely on postinstall hooks."}},{"@type":"Question","name":"How does the Shai-Hulud npm worm spread through dependencies?","acceptedAnswer":{"@type":"Answer","text":"Shai-Hulud spreads by exploiting npm's postinstall script feature, a shell script that runs automatically when a package or any of its transitive dependencies is installed. Once triggered, it steals credentials such as AWS, GCP, and Azure tokens plus npm publish and OIDC tokens, then uses them to publish more malicious packages, propagating further across the ecosystem since at least October of last year. Developers auditing dependency trees for postinstall risk can follow supply chain security coverage on daily.dev."}},{"@type":"Question","name":"What is npm's minimum release age setting and why would I enable it?","acceptedAnswer":{"@type":"Answer","text":"Minimum release age is an npm setting that blocks installation of packages younger than a specified number of days or weeks. It helps because most recent npm supply chain compromises were detected within one to two days, some in as little as 90 minutes, so delaying adoption of brand-new package versions reduces exposure to freshly published malicious releases. Teams weighing dependency update policies can keep up with npm security settings via daily.dev."}}]} ```