NPM v12’s Deny-by-Default Scripts Improve Security, but Risks Remain

Summary

NPM v12 will disable install scripts and require opt-ins for some dependency types. The author welcomes the changes but warns of approval fatigue, attackers shifting execution paths, and added detection challenges, while recommending cooldowns, allowlists, and package ﬁ

Key points

NPM v12 is expected around July 2026; it will disable lifecycle scripts by default and require explicit flags for Git and remote URL dependencies.
Developers can prepare on NPM 11.16.0+ with `npm approve-scripts`, `npm approve-scripts --allow-scripts-pending`, and `npm deny-scripts`.
The author warns that frequent breakage could lead developers to approve scripts reflexively, weakening the protection.
The article argues that malware could shift to other execution paths, such as shell scripts or downloaded binaries, rather than disappear.
The author says stricter defaults may make legitimate package behavior look more suspicious and complicate detection.
Cooldowns and package-firewall tools can help block malicious releases, but the author says they are not sufficient on their own.
Recommendations include enabling cooldowns, preparing script allowlists, using package firewalls where practical, and understanding dependencies.