npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk

GitHub has officially released npm version 12, introducing significant security changes to reduce software supply chain risks. The most notable change is that install scripts are now disabled by default, making previously automatic behaviors opt-in. This includes dependency lifecycle scripts (preinstall, install, postinstall) and implicit node-gyp builds, which no longer run unless explicitly allowed via the allowScripts setting. Additionally, Git dependencies and remote URL dependencies (e.g., HTTPS tarballs) are no longer resolved unless explicitly permitted through –allow-git and –allow-remote settings, respectively.

To manage trusted scripts, users must run npm approve-scripts –allow-scripts-pending and commit the resulting allowlist in package.json. These changes were previewed in npm 11.16.0, and GitHub recommends upgrading to that version or newer to review warnings.

npm 12 also deprecates granular access tokens (GATs) configured to bypass two-factor authentication (2FA). Starting in early August 2026, such tokens will no longer perform sensitive account, package, or organization management actions, including creating or deleting tokens, generating recovery codes, changing account details, or managing team memberships. By January 2027, GATs will lose direct publishing capabilities, limited to reading private packages and staging a publish that requires human 2FA approval. GitHub advises moving to trusted publishing (OIDC) or staged publishing with human approval.

In related news, pnpm 11.10 introduces a new _auth setting for registry authentication as a single structured, URL-keyed value. This prevents malicious project files from redirecting tokens to different hosts, reducing credential theft risks.