npm 12 Makes Install Scripts and Git/Remote Dependencies Opt-In
Summary
npm 12 disables lifecycle scripts and Git and remote URL dependencies by default, requiring approval. GitHub also announced limits on 2FA-bypass tokens, while pnpm 11.10 adds registry-bound authentication configuration.
Key points
- npm 12 disables dependency lifecycle scripts and implicit node-gyp builds by default; users must approve trusted scripts and save the allowlist in package.json.
- Git and remote URL dependencies no longer resolve by default and require explicit opt-in.
- GitHub plans to restrict npm granular access tokens that bypass 2FA from sensitive management actions, with the first change expected in early August 2026.
- Those tokens are also scheduled to lose direct publishing ability in January 2027; publishing will require a human 2FA approval or a different workflow.
- pnpm 11.10 adds a structured _auth setting that ties credentials to a registry host and is read only from the environment or global configuration, not project files.
Article Details
- Event Type
- Package-manager security updates
- Impact
- npm 12 disables lifecycle scripts, Git dependencies, and remote URL dependencies by default, requiring explicit approval. GitHub also plans to restrict npm granular access tokens that bypass 2FA, including limiting direct publishing. pnpm 11.10's structured _auth setting keeps registry credentials tied to their host and prevents project configuration files from redirecting those credentials.
Vendors
Products
npmGitHub has released npm 12 with install scripts, Git dependencies, and remote URL dependencies disabled by default, requiring explicit approval through a new trust workflow.pnpmIt also announced future restrictions on npm granular access tokens used to bypass 2FA, while pnpm 11.10 adds a safer structured _auth setting to better protect registry credentials.