NPM v12: 3 Security Breaking Changes Every Node.js Developer Needs to Know

npm install Won't Run Scripts Automatically Anymore

If you're a Node.js developer, npm install is muscle memory. You type it, it runs, everything works. But here's what most people don't think about: every time npm install runs, dozens of scripts from your dependencies execute silently — preinstall, install, postinstall. No questions asked, no warnings given.

Come July 2026, that changes.

GitHub just announced three breaking changes for NPM v12, all centered on one theme: supply chain security. No more automatic script execution from unapproved packages. No more auto-pulling Git dependencies. No more auto-fetching from remote URLs.

These changes will affect every Node.js developer's workflow. The good news: you can prepare starting today.

Why These Changes Are Necessary

Before diving into details, it's worth understanding why. The NPM ecosystem has a fundamental weakness: installing a package means trusting its code to run on your machine. A malicious postinstall script can steal tokens, plant backdoors, or spread to other projects — all within seconds of running npm install.

Supply chain attacks are no longer theoretical. The colors.js sabotage (2022), xz utils backdoor (2024), and countless typosquatting packages have proven that an innocent npm install can open the door to attackers.

NPM v12 is a direct response to that reality.

Breaking Change #1: allowScripts Defaults to false

This is the biggest change and will affect the most developers.

Currently (v11): When you run npm install, all preinstall, install, and postinstall scripts from every dependency execute automatically. This includes implicit node-gyp rebuild — even if a package has binding.gyp but no explicit install script, NPM runs the build anyway.

Starting in v12: All scripts are blocked unless you explicitly allow each package. No allowlist = no scripts run.

What does this mean in practice? If your project uses packages like node-sass, bcrypt, or anything requiring native builds — npm install won't build them unless you've approved them first.

How to Prepare

NPM provides tooling to prepare starting now (v11.16.0+):

# Upgrade to latest npm
npm install -g npm@latest

# See which packages have scripts that are "pending" (will be blocked in v12)
npm approve-scripts --allow-scripts-pending

# Allow packages you trust
npm approve-scripts bcrypt node-sass

# Deny the rest
npm deny-scripts

After running these, NPM writes the allowlist to package.json:

{
  "allowScripts": {
    "bcrypt@5.1.1": true,
    "node-sass@9.0.0": true
  }
}

Commit this file — it's the single source of truth for which scripts run once you upgrade to v12.

Breaking Change #2: --allow-git Defaults to none

Currently: You can declare dependencies directly from Git repositories:

{
  "dependencies": {
    "my-fork": "git+https://github.com/user/repo.git#branch"
  }
}

And npm install clones and installs them automatically. No questions.

The problem: A Git dependency can contain a .npmrc file that overrides the Git executable, opening a code execution path even with --ignore-scripts. An attacker only needs to slip in a transitive Git dependency.

Starting in v12: Git dependencies are blocked by default. You must add the --allow-git flag to enable them.

This is a significant shift for teams using private Git repositories as a package registry. But given increasingly sophisticated supply chain attacks, it's a reasonable trade-off.

Note: --allow-file and --allow-directory (used for local development) are not changing their defaults in v12.

Breaking Change #3: --allow-remote Defaults to none

Similar to Git, installing packages from remote URLs (HTTPS tarballs) is also blocked by default:

{
  "dependencies": {
    "some-pkg": "https://example.com/package.tgz"
  }
}

→ Won't resolve unless you add --allow-remote.

This is the least impactful change since most teams use the npm registry or a private registry, not raw URLs. But if your CI/CD pipeline has a step that fetches packages from URLs, update it now.

Timeline and Real-World Impact

Milestone	Event
Now (npm 11.16.0+)	Warnings shown during npm install, nothing blocked yet
July 2026	NPM v12 released, all three changes become defaults

Who's most affected?

• Teams using many native addons (node-sass, bcrypt, sharp, canvas...) — need to approve scripts per package
• Teams using Git dependencies in monorepos or private packages — need --allow-git
• CI/CD pipelines — all scripts need updating with new flags

Who's least affected?

• Pure JS projects with no native builds
• Teams using npm registry + private registry (sinopia/verdaccio)
• Projects that already audit dependency scripts

Takeaways

• Prepare now: Upgrade to npm ≥11.16.0, run npm approve-scripts --allow-scripts-pending, review and approve
• CI/CD: Add --allow-git and --allow-remote to your pipeline if needed
• New mindset: Scripts from dependencies are no longer a given — they must be explicitly permitted
• Security over convenience: These three changes add some friction, but in return you get a significantly safer ecosystem

July isn't far off. Audit your projects today — don't be the one whose npm install suddenly stops building on a Monday morning.

---

Content assisted by AI (Amy 🌸). Reviewed by the author.