NPM 12 Will Change Script Execution Behavior to Prevent Supply Chain Attacks
NPM 12 will block script execution from dependencies by default to prevent supply chain attacks.
GitHub is updating NPM to version 12, set for release in July, to prevent supply chain attacks. By default, npm install will no longer automatically execute scripts from dependencies, a method recently exploited by malware like the Shai-Hulud worm. Developers will need to explicitly allow scripts from trusted packages to maintain current functionality.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GitHub?
Get an email when a new story names GitHub, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe automatic execution of scripts during npm package installation created a dangerous attack vector that malware like Shai-Hulud exploited to compromise systems. By automatically running code from untrusted dependencies, developers unknowingly gave malicious packages the ability to execute arbitrary commands on their systems. NPM 12's change to require explicit approval for script execution represents a critical shift toward secure-by-default behavior. This highlights the broader risk of trusting third-party code without proper vetting and the importance of implementing least-privilege principles in development workflows.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.