GitHub to Disable npm Install Scripts by Default to Combat Supply Chain Attacks

GitHub has announced significant security changes for npm version 12, set to release next month, aimed at mitigating software supply chain attacks. The primary change disables install scripts by default, addressing what GitHub describes as the ‘single largest code-execution surface in the npm ecosystem.’

Install-time lifecycle scripts (preinstall, install, postinstall) have been a common vector for attackers to execute malicious code on developer machines or CI runners. By making script execution opt-in, GitHub requires explicit user approval before any code runs during ‘npm install.’

Additional changes include: npm install will no longer resolve Git dependencies unless explicitly allowed via ‘–allow-git’; it will no longer resolve dependencies from remote URLs (e.g., HTTPS tarballs) unless allowed via ‘–allow-remote’; and native node-gyp builds are also blocked by default. The ‘–allow-git’ setting defaults to ‘none,’ closing a code execution path where a Git dependency’s .npmrc could override the Git executable even with ‘–ignore-scripts.’

GitHub recommends developers upgrade to npm 11.16.0 or newer, run normal installs, review warnings, and use ‘npm approve-scripts –allow-scripts-pending’ to approve trusted packages. Earlier this year, npm also introduced ‘min-release-age’ to reject newly published malicious packages.