--- title: npm install-time security and GAT bypass2fa deprecation description: npm v12 is now generally available with two major security changes. First, install-time security defaults are now enabled: dependency lifecycle scripts, git... canonical: https://daily.dev/posts/npm-install-time-security-and-gat-bypass2fa-deprecation-hwjz1gmag twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: npm install-time security and GAT bypass2fa deprecation | daily.dev og:description: npm v12 is now generally available with two major security changes. First, install-time security defaults are now enabled: dependency lifecycle scripts, git... og:url: https://daily.dev/posts/npm-install-time-security-and-gat-bypass2fa-deprecation-hwjz1gmag og:image: https://api.daily.dev/og/posts/HWjZ1gmag.png og:image:alt: npm install-time security and GAT bypass2fa deprecation og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # npm install-time security and GAT bypass2fa deprecation **[GitHub Changelog](https://daily.dev/sources/github_updates)** · 3 min read · 0 upvotes · 0 comments ## Summary npm v12 is now generally available with two major security changes. First, install-time security defaults are now enabled: dependency lifecycle scripts, git dependencies, and remote URL dependencies no longer run automatically and must be explicitly opted into. Second, granular access tokens (GATs) configured to bypass 2FA will lose the ability to perform sensitive account, package, and organization management actions (expected August 2026), and will later lose direct publish capability (expected January 2027). Developers using automated publishing should migrate to trusted publishing via OIDC or staged publishing with human approval. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What changed in npm v12 regarding install-time security defaults? npm v12, now generally available, turns off automatic execution of dependency lifecycle scripts (preinstall, install, postinstall) and implicit node-gyp builds unless explicitly allowed via allowScripts. Git dependencies and remote URL/tarball dependencies also no longer resolve automatically, controlled by --allow-git and --allow-remote flags, both defaulting to none. These were available behind warnings since npm 11.16.0. _Teams upgrading to npm v12 can track breaking dependency changes like this one on daily.dev._ ### How do I prepare my package.json for npm v12's script execution changes before upgrading? Run npm approve-scripts --allow-scripts-pending to review and approve the lifecycle scripts you trust, then commit the resulting allowlist in package.json. This lets you audit which packages run preinstall, install, or postinstall scripts before npm v12 blocks them by default. The behaviors were available behind warnings in npm 11.16.0 and later, so preparation can happen before the actual upgrade. _Developers migrating dependency configs before a major npm upgrade often track these steps on daily.dev._ ### When will npm 2FA-bypass granular access tokens stop being able to publish packages directly? 2FA-bypass GATs are expected to lose direct publishing ability around January 2027, following an earlier change expected in early August 2026 that removes their ability to skip 2FA for sensitive account, package, and organization management actions. Afterward, these tokens can only read private packages and stage a publish, requiring human 2FA approval before a package goes public. Maintainers should move automated publishing to trusted publishing (OIDC) or staged publishing. _Maintainers planning automated publishing pipelines around a token deprecation timeline can follow updates on daily.dev._ ## Similar posts on daily.dev - [Restricting npm bypass-2FA granular access tokens](https://daily.dev/posts/restricting-npm-bypass-2fa-granular-access-tokens-vh2dwd8rj) · GitHub Changelog · 0 upvotes · 0 comments - [npm v12 Ships With Install Scripts Off by Default, Begins De...](https://daily.dev/posts/npm-v12-ships-with-install-scripts-off-by-default-begins-de--mrvcfgl6f) · Socket · 1 upvotes · 0 comments - [npm v12’s Biggest Security Change: From Implicit to Explicit Trust](https://daily.dev/posts/npm-v12-s-biggest-security-change-from-implicit-to-explicit-trust-2d4pdcf9o) · JFrog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/npm-install-time-security-and-gat-bypass2fa-deprecation-hwjz1gmag) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"npm install-time security and GAT bypass2fa deprecation","url":"https://daily.dev/posts/npm-install-time-security-and-gat-bypass2fa-deprecation-hwjz1gmag","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/npm-install-time-security-and-gat-bypass2fa-deprecation-hwjz1gmag"},"datePublished":"2026-07-08T16:15:44.552Z","dateModified":"2026-09-14T08:55:39.182Z","description":"npm v12 is now generally available with two major security changes. First, install-time security defaults are now enabled: dependency lifecycle scripts, git...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/73da122c45034dc2effb3824aeb80cfa?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/73da122c45034dc2effb3824aeb80cfa?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"GitHub Changelog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitHub Changelog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/15004b7835da4d89b02b115871f0f6dc","url":"https://daily.dev/sources/github_updates"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/npm-install-time-security-and-gat-bypass2fa-deprecation-hwjz1gmag","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,authentication,npm","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitHub Changelog","item":"https://daily.dev/sources/github_updates"},{"@type":"ListItem","position":3,"name":"npm install-time security and GAT bypass2fa deprecation"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/npm-install-time-security-and-gat-bypass2fa-deprecation-hwjz1gmag#faq","mainEntity":[{"@type":"Question","name":"What changed in npm v12 regarding install-time security defaults?","acceptedAnswer":{"@type":"Answer","text":"npm v12, now generally available, turns off automatic execution of dependency lifecycle scripts (preinstall, install, postinstall) and implicit node-gyp builds unless explicitly allowed via allowScripts. Git dependencies and remote URL/tarball dependencies also no longer resolve automatically, controlled by --allow-git and --allow-remote flags, both defaulting to none. These were available behind warnings since npm 11.16.0. Teams upgrading to npm v12 can track breaking dependency changes like this one on daily.dev."}},{"@type":"Question","name":"How do I prepare my package.json for npm v12's script execution changes before upgrading?","acceptedAnswer":{"@type":"Answer","text":"Run npm approve-scripts --allow-scripts-pending to review and approve the lifecycle scripts you trust, then commit the resulting allowlist in package.json. This lets you audit which packages run preinstall, install, or postinstall scripts before npm v12 blocks them by default. The behaviors were available behind warnings in npm 11.16.0 and later, so preparation can happen before the actual upgrade. Developers migrating dependency configs before a major npm upgrade often track these steps on daily.dev."}},{"@type":"Question","name":"When will npm 2FA-bypass granular access tokens stop being able to publish packages directly?","acceptedAnswer":{"@type":"Answer","text":"2FA-bypass GATs are expected to lose direct publishing ability around January 2027, following an earlier change expected in early August 2026 that removes their ability to skip 2FA for sensitive account, package, and organization management actions. Afterward, these tokens can only read private packages and stage a publish, requiring human 2FA approval before a package goes public. Maintainers should move automated publishing to trusted publishing (OIDC) or staged publishing. Maintainers planning automated publishing pipelines around a token deprecation timeline can follow updates on daily.dev."}}]} ```