GitHub Pulls Pin on Npm's Auto-Run Scripts
npm v12 will require explicit approval for dependency scripts and Git or URL sources, closing code-execution paths abused in recent attacks.
- GitHub announced next month its package manager will introduce security-focused changes requiring explicit approval for scripts and remote sources previously trusted by default.
- "This gets you protected against new, unexpected scripts immediately," Maintainer Leo Balter said, noting install-time lifecycle scripts currently trigger automatically from every transitive dependency.
- Starting in version 12, the manager blocks automatic installation scripts, Git-based dependencies, and remote URL fetching unless explicitly permitted by developers.
- Developers should upgrade to npm 11.16.0 now to identify workflows that will break, as the version displays warnings for all actions requiring explicit approval.
- While Bun, Deno, and Yarn Berry already block these scripts, some developers worry malware will move to modules, though consensus remains these changes are long overdue.
12 Articles
12 Articles
CSO Online
GitHub finally pulls the plug on automatic install script execution for npm
The change, expected in July, will likely block one of the more common attack vectors; developers are wondering what took GitHub so long, and why other repositories acted so much sooner.
GitHub Tightens npm Defaults in Version 12 to Block Malicious Install Scripts
GitHub has decided to pull the plug on a long-criticized behavior in npm. Starting with version 12, expected in July 2026, the install command will no longer run preinstall, install, or postinstall scripts from dependencies by default. The change directly targets a vector attackers have exploited with growing success in recent supply-chain incidents. Developers have known the risks for years. A single compromised package could execute arbitrary …
GitHub announces npm security changes to tackle supply-chain attacks
GitHub has announced that npm v12, expected next month, will introduce several security-focused changes aimed at blocking supply-chain attacks abusing behaviors triggered by the 'npm install' command.
The Register
IT Security News - cybersecurity, infosecurity newsGitHub pulls pin on npm's auto-run scripts
GitHub will change npm's defaults so the install command no longer runs scripts automatically, disabling a feature commonly exploited by malicious packages such as the notorious Shai-Hulud worm. Maintainer Leo Balter said: "Install-time lifecycle scripts are the single largest code-execution surface in the npm ecosystem. Every npm install runs scripts from every transitive dependency, so a single compromised package anywhere in your tree can exe…
A worm that replicates itself, thousands of secrets published in the open, cryptic wallets siphoned. npm v12 learns the lessons of the hecatombe: no more installation scripts will run without your consent.
GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks
GitHub has announced what it said are "breaking changes" coming to npm version 12, one of which turns off install scripts by default to combat software supply chain threats. The changes aim to combat attack techniques that abuse the "npm install" command to trigger the execution of malicious code using npm lifecycle hooks. "Npm install" is used to download and install all the necessary
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
