npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk
npm 12 disables install scripts by default to mitigate supply chain risks.
GitHub has released npm version 12, disabling install scripts by default to enhance supply chain security. This change requires explicit user approval for dependency lifecycle scripts and implicit node-gyp builds. Additionally, granular access tokens (GATs) that bypass two-factor authentication (2FA) will have their capabilities restricted, limiting sensitive account and package management actions.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonMalicious actors have long exploited npm lifecycle scripts (such as `preinstall` and `postinstall`) to execute arbitrary code the moment a dependency is installed, making the software supply chain a prime attack vector. By disabling these scripts by default, npm 12 forces developers to consciously approve execution, reducing the risk of silent, automated compromise. Additionally, restricting granular access tokens that could bypass 2FA closes a significant authentication gap that attackers have used to hijack package accounts and push malicious updates. These changes highlight how default-permissive configurations in developer tooling can create systemic risk across thousands of downstream projects. Organizations that have not reviewed their npm configurations or token management practices remain exposed to supply chain attacks even if their own code is clean.
What helps against this
How we list vendors
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.