2.1 allowScripts Disabled by Default#

This is the most far-reaching change. Starting from npm v12, the following lifecycle scripts no longer execute by default:

It’s worth noting that implicit node-gyp rebuilds are also blocked—even if a package doesn’t explicitly declare an install script, as long as it contains a binding.gyp file, native module compilation will still be triggered at install time, which also requires explicit authorization under v12.

2.2 --allow-git Defaults to none#

Git dependencies ("foo": "git+https://github.com/user/repo.git") are no longer resolved by default. This change closes a critical code execution path: a Git dependency’s .npmrc file can override the Git executable path, allowing attackers to bypass --ignore-scripts restrictions.

2.3 --allow-remote Defaults to none#

Remote URL dependencies (HTTPS tarballs, etc.) are likewise no longer resolved by default, further narrowing the window for unreviewed code to enter the dependency tree.

3.1 Alarming Attack Data#

The npm ecosystem has experienced an unprecedented wave of supply chain attacks over the past year:

3.2 Asymmetric Trust Model#

The traditional npm install model has a fundamental trust asymmetry:

• Only 2% of packages actually need to run install scripts (such as native module compilation or platform binary downloads)
• But 100% of packages have the ability to execute arbitrary code at install time
• A deeply nested transitive dependency’s install script is enough to compromise an entire system

This “trust everything by default” model is no longer sustainable in the current threat environment.

3.3 pnpm Has Already Validated This Path#

pnpm v10 was the first to implement a security model of blocking lifecycle scripts by default + explicit allowlist in January 2025. Over a year of practice has proven:

• The vast majority of projects only need to approve a very small number of packages (such as esbuild, sharp, node-gyp and other packages requiring native compilation)
• CI/CD pipelines can be automated through the allowlist in package.json
• The impact on developer experience is far less than expected, while the security benefits are enormous

The changes in npm v12 essentially roll out this proven security model across the entire npm ecosystem.

4.1 Immediate Action: Upgrade to npm 11.16.0+#

npm 11.16.0 (released in June 2026) already includes early warning mechanisms for all v12 changes. After upgrading, run npm install and you’ll see warnings about which scripts v12 will block, rather than being hard-blocked in July.

1
# Upgrade to the latest npm 11
2
npm install -g npm@11
3

4
# Run install in the project and observe the warnings
5
npm install

4.2 Review and Build an Allowlist#

npm 11 provides a brand-new approval workflow:

1
# View all packages with install scripts pending approval
2
npm approve-scripts --allow-scripts-pending
3

4
# Approve the packages you trust (written to package.json)
5
npm approve-scripts esbuild
6
npm approve-scripts sharp
7
npm approve-scripts node-gyp
8

9
# Reject packages you don't need
10
npm deny-scripts some-suspicious-package

4.3 Commit the Allowlist#

Approval results are written to package.json, which is a team decision that needs version control:

1
{
2
  "name": "my-project",
3
  "dependencies": {
4
    "esbuild": "^0.27.0",
5
    "sharp": "^0.34.0"
6
  },
7
  "allowScripts": {
8
    "esbuild": true,
9
    "sharp": true
10
  }
11
}

The advantages of the allowlist are:

• Reviewable: Every PR shows which packages have been granted install script permissions
• Traceable: Git history records the time and person behind each trust decision
• Automatable: CI/CD reads package.json directly, with no additional configuration needed

4.4 Handle Git Dependencies and Remote Dependencies#

If your project depends on Git repositories or remote URLs:

1
# Explicitly authorize in .npmrc or on the command line
2
npm install --allow-git=all          # Allow all Git dependencies
3
npm install --allow-git=foo/bar      # Allow only specific repositories
4
npm install --allow-remote=all       # Allow all remote URL dependencies

It’s recommended to migrate Git/remote dependencies to officially published packages on the npm registry as soon as possible, fundamentally eliminating the risk.

5.1 Docker Images#

If your Dockerfile has npm install -g global installs, you need to confirm whether these packages contain install scripts:

1
# Docker image for npm v12 (node:24+ will bundle npm v12)
2
FROM node:24
3

4
# Require explicit approval for global package scripts
5
RUN npm approve-scripts -g esbuild
6
RUN npm install -g esbuild

5.2 GitHub Actions / Other CI Environments#

1
- name: Install dependencies
2
  run: |
3
    # allowScripts in package.json will be read automatically
4
    npm install
5
    # If additional authorization is needed (not recommended), use:
6
    # npm install --allow-scripts=all

The recommended approach is to write allowScripts into package.json and commit it, so that CI environments need no additional configuration.

5.3 Emergency Fallback (Not Recommended)#

If a project temporarily cannot complete the migration, the old behavior can be restored through the following configuration:

1
# Globally restore the old behavior (high risk, not recommended)
2
npm install --allow-scripts=all --allow-git=all --allow-remote=all

However, it’s strongly recommended that this be used only as an emergency measure—attackers rely precisely on developers using such “wide-open” configurations long-term.

Immediate Action Checklist#

1. Upgrade npm: npm install -g npm@11
2. Run a full install once: Observe v12 compatibility warnings
3. Review install scripts: npm approve-scripts --allow-scripts-pending
4. Build an allowlist: Make an explicit decision for each package that needs scripts
5. Commit to the repository: Bring package.json in allowScripts under version control
6. Clean up Git/remote dependencies: Migrate to official npm registry packages wherever possible