cyber.hendryadrian.com
Security News · securityweek.com

GitHub to Block Dependency Scripts by Default in npm 12

· Original article ↗

Summary

GitHub says npm 12 will block dependency install scripts by default, responding to supply-chain attacks that abused automatic script execution. Developers can review and approve trusted scripts ahead of the change.

Key points

  • GitHub says npm 12, expected in July, will block dependency preinstall, install, and postinstall scripts unless projects explicitly allow them.
  • The change also affects native node-gyp builds and prepare scripts from Git, file, and link dependencies; the article says Shai-Hulud Miasma attacks abused a weaponized binding.gyp file.
  • Developers can use npm approve-scripts –allow-scripts-pending to review packages and create an allowlist in package.json.
  • With npm 11.16.0 or later, developers will receive warnings when an install routine executes scripts.
  • Git dependencies will no longer be resolved during npm install unless explicitly allowed; GitHub says this closes a code-execution path involving a Git dependency’s .npmrc.
  • npm 12 will also stop resolving dependencies from remote URLs, including HTTPS tarballs, unless developers allow them with the –allow-remote flag.

Article Details

Event Type
Software supply-chain security policy change
Impact
GitHub announced that npm 12, expected in July (year not stated), will block dependency lifecycle scripts by default unless explicitly approved. The change also affects native node-gyp builds and prepare scripts from git, file, and link dependencies; git dependencies and remote URL dependencies, including HTTPS tarballs, will no longer be resolved during installation unless allowed. The article says previous dependency-based attacks infected thousands of developers with malware.

MITRE ATT&CK

T1195.001 · Compromise Software Dependencies and Development ToolsThe article describes supply-chain attacks that abused automatic execution of scripts from dependencies to infect developers with malware.

Threat Actors

TeamPCPThe article says multiple supply-chain incidents were mainly associated with TeamPCP; this is reported association, not independently confirmed attribution.

Malware

Shai-Huludmajor incidents that occurred over the past several months, mainly associated with TeamPCP and the Shai-Hulud self-replicating worm, have been abusing the default, automatic execution of scripts from dependencies

Vendors

GitHubIn response to a recent wave of supply chain attacks targeting the NPM ecosystem, GitHub announced that scripts from dependencies will no longer be executed by default.

Products

npmIn response to a recent wave of supply chain attacks targeting the NPM ecosystem, GitHub announced that scripts from dependencies will no longer be executed by default.

Related Articles