npm v12 will block install scripts and Git dependencies by default

npm’s next major release, v12, expected in July 2026, flips three install-time behaviors from automatic to opt-in, all aimed at shrinking the package manager’s supply-chain attack surface. The headline change: lifecycle scripts (preinstall, install, postinstall) from dependencies will no longer run unless explicitly allowlisted per project. The block extends to implicit node-gyp rebuilds for native packages and to prepare scripts from git, file, and link dependencies. A new approve-scripts/deny-scripts workflow writes the allowlist into package.json so teams can commit and review which packages are trusted to execute code at install time.

The other two changes lock down where dependencies come from. Git dependencies will be refused unless enabled with —allow-git — closing a known code-execution hole where a Git dependency’s .npmrc could swap out the Git executable even when scripts were disabled. Remote URL dependencies, such as https tarballs, similarly require —allow-remote. File and directory dependencies keep their current defaults.

Every new default is already available behind warnings in npm 11.16.0+, so teams can upgrade now, run a normal install, audit the warnings, and approve trusted packages before v12 ships. Anything left unapproved simply stops running after the upgrade. Given how many recent npm supply-chain attacks have leaned on install scripts as their execution vector, this is one of the most consequential hardening moves the registry’s tooling has made — and it shifts npm toward the deny-by-default posture pnpm and others have already adopted.