npm v12 to enforce stricter security defaults for package installation
npm v12, slated for July 2026, introduces security enhancements by defaulting to stricter controls for package installation scripts and Git/remote dependencies. These changes aim to mitigate code execution risks by requiring explicit user opt-in for potentially risky operations. Users on npm 11.16.0 or newer can prepare by reviewing warnings and using `npm approve-scripts` to manage trusted packages.
- →npm install to disable execution of preinstall, install, postinstall scripts by default
- →npm install to block Git dependencies by default
- →npm install to block remote URL dependencies by default
- →Preparation for npm v12 breaking changes
Breaking changes (3) ›
- npm install to disable execution of preinstall, install, postinstall scripts by default
npm v12 will change `allowScripts` to default to off, meaning install scripts from dependencies will not run automatically. This includes native node-gyp builds and prepare scripts from git, file, and link dependencies. Users can preview blocked scripts with `npm approve-scripts --allow-scripts-pending` and manage trust with `npm approve-scripts` and `npm deny-scripts`, committing the resulting allowlist to package.json.
- npm install to block Git dependencies by default
The `--allow-git` flag will default to 'none' in npm v12, preventing automatic resolution of Git dependencies, both direct and transitive. This change closes a code-execution path where a Git dependency's `.npmrc` could override the Git executable. This functionality is available in npm 11.10.0+.
- npm install to block remote URL dependencies by default
npm v12 will change `--allow-remote` to default to 'none', meaning dependencies from remote URLs like https tarballs will not be resolved unless explicitly allowed. This flag is available in npm 11.15.0+; `--allow-file` and `--allow-directory` defaults remain unchanged.
Notes (1) ›
- Preparation for npm v12 breaking changes
To prepare for npm v12, users should upgrade to npm 11.16.0 or later, run their usual installs to observe warnings, and use `npm approve-scripts --allow-scripts-pending` to identify and approve trusted package scripts. Approved scripts will continue to run post-upgrade, while unapproved ones will be blocked.
https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12