GitHub to Require Approval for npm Scripts and Non-Registry Dependencies
Summary
npm v12 will require explicit approval for dependency install scripts, Git dependencies, and remote URL sources. GitHub recommends npm 11.16.0 or newer so developers can review warnings before upgrading.
Key points
- npm v12 is expected next month and will stop dependency preinstall, install, and postinstall scripts from running by default without approval.
- Prepare scripts from Git, local file, and linked dependencies will also require approval; this includes native module builds triggered through node-gyp.
- Direct and transitive Git dependencies will not be fetched automatically unless explicitly permitted.
- Remote URL dependencies, including HTTPS tarballs, will require explicit approval.
- GitHub says the changes address risks including install-script campaigns targeting eslint-config-prettier and Toptal’s Picasso packages, and Git dependency abuse documented in Shai-Hulud attacks.
- GitHub recommends upgrading to npm 11.16.0 or newer to review warnings and identify workflows that may need changes before npm v12.
Article Details
- Event Type
- GitHub announced planned security changes to npm’s dependency installation behavior in npm v12.
- Impact
- npm v12 is expected to require explicit approval for dependency install scripts, Git-based dependencies, and remote URL dependencies, reducing automatic code-execution and dependency-resolution paths used in supply-chain attacks. Projects relying on these behaviors will need to opt in. GitHub recommends upgrading to npm 11.16.0 or newer to review compatibility warnings.