npm 12 blocks install scripts by default — your CI just changed

The single most reliable way to get malware onto a developer machine for the last decade has been the npm install script — a postinstall hook that runs arbitrary code the moment you pull a dependency. As of npm 12, that door is shut by default. It's the right move, and it will also break builds that were quietly depending on the old behavior. If you ship anything on Node, your CI's defaults changed this month whether you noticed or not.

What actually happened

GitHub announced npm 12 on July 8, 2026, after pre-announcing the breaking changes in June. Per The Hacker News, three install behaviors now require explicit approval:

• Lifecycle scripts — preinstall, install, and postinstall from dependencies no longer run automatically. This includes the implicit node-gyp rebuild that fires for any package with a binding.gyp, so native modules are affected even without an explicit script.
• Git dependencies, direct or transitive, won't resolve unless you pass --allow-git.
• Remote-URL dependencies, like HTTPS tarballs, won't resolve unless you pass --allow-remote.

You allow the packages you trust with npm approve-scripts and commit the resulting allowlist to your package.json; npm deny-scripts blocks the rest. All of it has been available behind warnings since npm 11.16.0, so you could have been staging the migration for a month. The motivation is not hypothetical — 2026 has been a parade of npm supply-chain compromises, including a Microsoft-documented @asyncapi campaign that executed at module-load time rather than the usual postinstall hook.

Why the npm 12 default matters for your business

Two things land on your desk from this.

First, your build might already be broken and you don't know it. If a dependency in your tree relies on a native rebuild or a lifecycle script — image processing, database drivers, crypto libraries all commonly do — a fresh npm install on npm 12 will skip it, and you'll get a runtime failure that looks nothing like a dependency problem. Run your CI against npm 12 in a branch this week. Find the packages that actually need scripts, approve exactly those, and commit the allowlist. That list is now a security artifact: it's the explicit, reviewable set of code you let run at install time.

Second, secure defaults are finally shipping upstream, and that's leverage. For years, "audit what your install runs" was advice nobody had time for. npm just made the safe path the default one, which means the payoff for a small team is real: fewer places for a compromised transitive dependency to execute before your code ever imports it. The teams that lose here are the ones that flip --ignore-scripts off globally to make the red go away — that hands the door right back.

Sources: GitHub Changelog, The Hacker News, Microsoft Security.