GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- GitHub announced that npm version 12 will disable preinstall, install, and postinstall scripts from dependencies by default, requiring explicit allowance.
- GitHub will block resolution of Git dependencies (direct or transitive) during npm install unless the user specifies --allow-git.
- GitHub will block resolution of dependencies from remote URLs (e.g., HTTPS tarballs) unless the user specifies --allow-remote.
- GitHub also blocks native node-gyp builds because npm runs an implicit node-gyp rebuild even without an explicit install script.
- GitHub advises developers to upgrade to npm 11.16.0 or newer, run a normal install to view warnings, and use npm approve-scripts --allow-scripts-pending to approve trusted scripts.
Why it matters: Developers and CI pipelines gain tighter security as the largest code‑execution surface in npm is narrowed, while malicious package authors lose the ability to run arbitrary code silently, forcing a shift to explicit script approval. GitHub's default blocking of Git and remote URL dependencies also removes a common vector for supply‑chain attacks, further reducing risk for production environments.
Ask SkimNews
