GitHub officially released npm version 12, and it comes with a major security change: install scripts are now disabled by default.
This is a big deal for anyone who’s dealt with a compromised npm package. Malicious install scripts have been a favorite vector for supply chain attacks — they run automatically when you install a package, giving attackers a clean shot at your system.
Here’s what changed. The allowScripts setting now defaults to off. That means dependency lifecycle scripts — preinstall, install, postinstall — plus implicit node-gyp builds won’t run unless you explicitly allow them. The –allow-git and –allow-remote flags also default to none, so Git dependencies and remote URL tarballs are off the table by default too.
To approve trusted scripts, you run “npm approve-scripts –allow-scripts-pending” and commit the resulting allowlist to package.json. It’s opt-in, not opt-out.
npm 12 also deprecates granular access tokens (GATs) designed to bypass two-factor authentication. Starting in August 2026, GATs configured to bypass 2FA won’t be able to perform sensitive account or package management actions — creating tokens, changing passwords, managing maintainers, that kind of thing. Publishing with GATs gets restricted too. By January 2027, GATs lose the ability to publish directly; they’ll only be able to stage a publish, which requires human 2FA approval to go live.
GitHub recommends moving automated publishing to trusted publishing (OIDC) or staged publishing with human approval instead of using long-lived tokens.
The npm ecosystem has been a prime target for years. This is a solid step toward locking it down. If you manage packages or CI pipelines, now’s the time to test your workflows against npm 12.
