npm v12 tightens security: scripts, Git, and remote installs blocked by default
npm v12 breaks installs by default – here's how to prepare before July 2026.
npm v12, expected in July 2026, marks a major shift in default install behavior. The `allowScripts` config will default to `false`, meaning `npm install` will no longer run preinstall, install, or postinstall scripts from any dependency — including native `node-gyp` builds. Git dependencies (direct or transitive) will require `--allow-git` to resolve, closing a code-execution vector where a dependency's `.npmrc` could override the Git executable even with `--ignore-scripts`. Similarly, remote URL tarballs (https) will require `--allow-remote`. These changes are opt-in by default now, but warnings appear in npm 11.16.0+.
To prepare, upgrade to npm 11.16.0+, run your normal install, and review warnings with `npm approve-scripts --allow-scripts-pending`. Approve trusted packages and commit the updated `package.json`. Any scripts left unapproved will stop running after the upgrade. The `--allow-file` and `--allow-directory` flags remain unchanged. This is a proactive security move by the npm team, forcing developers to explicitly trust dependencies rather than relying on permissive defaults.
- npm v12 defaults allowScripts to off, blocking all script execution from dependencies including node-gyp builds.
- Git dependencies are blocked by default (--allow-git none) to prevent .npmrc-based code execution attacks.
- Remote tarballs (https) require explicit opt-in via --allow-remote; warnings available starting npm 11.15.0.
Why It Matters
Forces developers to audit and explicitly trust dependencies, reducing supply-chain attack risks in Node.js projects.