npm 12 flips three install-time behaviors from opt-out to opt-in: allowScripts now defaults off (blocking preinstall/install/postinstall scripts and implicit node-gyp builds), --allow-git defaults to none (closing a code execution path via a dependency's own .npmrc overriding the Git executable), and --allow-remote defaults to none (blocking https tarball dependencies). Teams had warnings since npm 11.16.0 to prepare, and GitHub's migration guide recommends allowing what's already installed before tightening further. Global installs and npx need config-based allowlisting instead of approve-scripts. Community reaction is largely positive, though some flag approval fatigue and an allowlist with no dependency scope as risks; JFrog reports these three vectors were involved in roughly 53% of malicious npm attacks over the past year. npm is the last major package manager (after pnpm, yarn, and bun) to adopt this kind of script-execution control.
Questions this post answers
Does npm 12 run postinstall scripts automatically like older versions did?
No, npm 12 turns off allowScripts by default, so preinstall, install, and postinstall scripts from dependencies no longer run automatically, including implicit node-gyp builds for packages with a binding.gyp file. Developers must explicitly approve scripts using npm approve-scripts and commit the resulting allowlist to package.json, or use npm config set allow-scripts for global installs and npx. Teams migrating to npm 12's script allowlisting can track breaking package manager changes like this on daily.dev.
What changed with --allow-git and --allow-remote flags in npm 12?
Both now default to none instead of allowing these sources automatically. --allow-git blocks a code execution path where a Git dependency's own .npmrc could override the Git executable even with --ignore-scripts set, while --allow-remote blocks https tarball dependencies; --allow-file and --allow-directory remain unchanged. Developers auditing dependency sources after an npm upgrade can follow security-relevant changes like these on daily.dev.
How much of npm supply-chain attacks involve install scripts, Git dependencies, or remote tarballs?
Roughly 53% of malicious npm attacks observed over the past year involved these three vectors, according to JFrog's analysis of npm 12's security changes. This figure underpinned the decision to make install scripts, Git dependency execution, and remote tarball installs opt-in rather than automatic in npm 12. Anyone weighing npm's new script-approval workflow against attack risk can find this kind of context on daily.dev.
285.9K Impressions6 Comments