--- title: npm v12 Is Coming in July — Here's What Developers Need... description: npm v12, releasing in July 2026, makes install scripts, Git dependencies, and remote URL dependencies opt-in rather than automatic. This is a direct response... canonical: https://daily.dev/posts/npm-v12-is-coming-in-july-here-s-what-developers-need-to-do-now-vgjujss9s twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: npm v12 Is Coming in July — Here's What Developers Need to Do Now | daily.dev og:description: npm v12, releasing in July 2026, makes install scripts, Git dependencies, and remote URL dependencies opt-in rather than automatic. This is a direct response... og:url: https://daily.dev/posts/npm-v12-is-coming-in-july-here-s-what-developers-need-to-do-now-vgjujss9s og:image: https://api.daily.dev/og/posts/VgjUjSS9s.png og:image:alt: npm v12 Is Coming in July — Here's What Developers Need to Do Now og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # npm v12 Is Coming in July — Here's What Developers Need to Do Now **[DevOps.com](https://daily.dev/sources/devops)** · 5 min read · 30 upvotes · 2 comments ## Summary npm v12, releasing in July 2026, makes install scripts, Git dependencies, and remote URL dependencies opt-in rather than automatic. This is a direct response to a surge in supply chain attacks — including the hijacking of 18 popular packages in 2025 and the Axios compromise in March 2026. Teams can prepare now using npm 11.16.0's advisory mode, which surfaces warnings without breaking builds. The recommended workflow involves running npm approve-scripts to audit which packages have unapproved scripts, then explicitly allowlisting only trusted ones pinned to reviewed versions. Package maintainers should document the change and consider shipping prebuilt binaries to reduce install script reliance. The change represents a fundamental shift from implicit to explicit trust in the npm ecosystem. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@springtofigh** · 0 upvotes > July 2026? Isn't it a little late after the 2025 hijacking? **@thequantumdev** · 0 upvotes > Thank God i stopped using axios for a while, what if they could steal my API data from the the breach ## Similar posts on daily.dev - [Upcoming breaking changes for npm v12](https://daily.dev/posts/upcoming-breaking-changes-for-npm-v12-bjzmyslik) · GitHub Changelog · 107 upvotes · 16 comments - [npm v12 delivers one of the biggest security improvements in years](https://daily.dev/posts/npm-v12-delivers-one-of-the-biggest-security-improvements-in-years-v9aauccwh) · Aikido Security · 69 upvotes · 3 comments - [GitHub announces npm security changes to tackle supply-chain attacks](https://daily.dev/posts/github-announces-npm-security-changes-to-tackle-supply-chain-attacks-utlkr6lo8) · BleepingComputer · 0 upvotes · 0 comments - [npm v12’s Biggest Security Change: From Implicit to Explicit Trust](https://daily.dev/posts/npm-v12-s-biggest-security-change-from-implicit-to-explicit-trust-2d4pdcf9o) · JFrog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#javascript](https://daily.dev/tags/javascript), [#nodejs](https://daily.dev/tags/nodejs), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/npm-v12-is-coming-in-july-here-s-what-developers-need-to-do-now-vgjujss9s) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"npm v12 Is Coming in July — Here's What Developers Need to Do Now","url":"https://daily.dev/posts/npm-v12-is-coming-in-july-here-s-what-developers-need-to-do-now-vgjujss9s","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/npm-v12-is-coming-in-july-here-s-what-developers-need-to-do-now-vgjujss9s"},"datePublished":"2026-06-11T16:01:52.971Z","dateModified":"2026-06-11T16:02:22.079Z","description":"npm v12, releasing in July 2026, makes install scripts, Git dependencies, and remote URL dependencies opt-in rather than automatic. This is a direct response...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8c1c557465629bc6c1d613c4457d34e8?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8c1c557465629bc6c1d613c4457d34e8?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"DevOps.com","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"DevOps.com","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/db8f2265cff0416c878c6e7e92bb8715","url":"https://daily.dev/sources/devops"},"commentCount":2,"discussionUrl":"https://daily.dev/posts/npm-v12-is-coming-in-july-here-s-what-developers-need-to-do-now-vgjujss9s","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":30},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":2}],"keywords":"security,javascript,nodejs,npm","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"DevOps.com","item":"https://daily.dev/sources/devops"},{"@type":"ListItem","position":3,"name":"npm v12 Is Coming in July — Here's What Developers Need to Do Now"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/npm-v12-is-coming-in-july-here-s-what-developers-need-to-do-now-vgjujss9s","comment":[{"@type":"Comment","text":"July 2026? Isn’t it a little late after the 2025 hijacking?","datePublished":"2026-06-14T20:41:36.581Z","url":"https://daily.dev/posts/VgjUjSS9s#c-nhJMJXYJW","author":{"@type":"Person","name":"Spring Tofigh","url":"https://daily.dev/springtofigh","image":"https://avatars.githubusercontent.com/u/90114320?v=4"}},{"@type":"Comment","text":"Thank God i stopped using axios for a while, what if they could steal my API data from the the breach","datePublished":"2026-06-17T19:08:59.200Z","url":"https://daily.dev/posts/VgjUjSS9s#c-8jlLCSyf6","author":{"@type":"Person","name":"Ronald Okuk","url":"https://daily.dev/thequantumdev","image":"https://media.daily.dev/image/upload/s--3C56b079--/f_auto/v1784416960/avatars/avatar_cEd1wiiphmPmZK8ibrjig?_a=BAMAMicg0"}}]} ```