npm outlines secure-by-default install changes for version 12

GitHub outlined breaking install defaults planned for npm 12 on June 9. Dependency preinstall, install, and postinstall scripts will no longer run unless a project approves them, and implicit native node-gyp builds are included in that restriction. The npm announcement also describes explicit controls for dependencies fetched from Git, remote URLs, local files, and directories.

Installation becomes an allowlist

Install scripts are powerful because they execute during dependency resolution, often before application code receives scrutiny. Turning them off by default moves that decision into project configuration. This can reduce an attacker’s automatic execution path, but it also affects legitimate packages that compile native addons, download platform binaries, or prepare generated assets.

GitHub said npm 11.16.0 and later can warn about the future behavior before teams install version 12. The post estimated a July release; maintainers should verify the final npm release notes rather than treating an estimate as the availability date.

Build the allowlist from observed need

Run clean installs in CI with the migration warnings enabled and on every supported operating system and architecture. Review each package requesting a script: identify the exact command, why it is needed, and whether a prebuilt or script-free alternative exists. Commit approvals through the project’s normal code-review path so a dependency update cannot expand execution unnoticed.

Test developer workflows as well as production builds. Local workspace and file dependencies can be common in monorepos, while Git or remote tarball dependencies may hide in lockfiles. A successful warm install is insufficient because caches can mask blocked setup. Use a new cache and verify the produced binaries and generated files. If teams must temporarily retain broader behavior, record an owner and removal date; otherwise a compatibility exception can become a permanent bypass of the new default.