Skip to content

Back to the catalog

The Pros and Cons of NPM v12's Security Improvements
opensourcemalware.comarticle

The Pros and Cons of NPM v12's Security Improvements

An analysis of npm v12 (shipping ~July 2026, previewable on npm 11.16.0+), which flips three dangerous defaults to deny-by-default: automatic preinstall/install/postinstall lifecycle scripts, git dependencies (now requiring --allow-git), and remote HTTPS tarball dependencies (now requiring --allow-remote). The author, a DEF CON speaker on install-script abuse, argues the changes are genuinely good but warns that widespread legitimate use of install scripts (esbuild, sharp, core-js, puppeteer, node-gyp native builds) will drive developers toward reflexive npm approve-scripts approval, and that attackers will simply relocate payload execution outside npm's visibility (curl|bash in install.js, bootstrap binaries), citing DPRK actors' continued abuse of VSCode tasks files even after Microsoft disabled task.allowAutomaticTasks by default. It also surveys complementary controls gaining traction across the ecosystem: npm's min-release-age cooldown (following pnpm's minimumReleaseAge, Yarn's npmMinimalAgeGate, and Bun) and package-firewall products (Datadog's supply-chain-firewall, Liran Tal's npq, Socket, Aikido, Endor Labs).

TL;DR npm v12 will deny-by-default install scripts and git/remote deps, but the author argues approval fatigue and attacker relocation (echoing DPRK's continued VSCode-tasks abuse) mean cooldowns and package firewalls remain necessary complements, not a solved problem.
Open original ↗
Document

What it is

A blog post from OpenSourceMalware analyzing the breaking security changes announced (on June 9) for NPM v12, shipping around July 2026. The author — a DEF CON speaker on npm install-script abuse — supports the changes but argues part of the benefit is theater. The value beyond the existing summary is the concrete preparation path and the specific limits of the protection.

What to do

You can prepare now rather than waiting for the July 2026 release:

  • NPM 11.16.0+ already supports the new tooling — upgrade and test against it before v12 lands.
  • Discover which packages in your tree rely on lifecycle scripts (so you can plan approvals before builds start breaking):
npm approve-scripts --allow-scripts-pending
  • Approve packages that legitimately need scripts:
npm approve-scripts
  • Explicitly block the rest:
npm deny-scripts

Expect immediate breakage on v12 landing for native/build-time packages the author names — esbuild, sharp, core-js, puppeteer, Nx, bufferutil, utf-8-validate, bcrypt — plus anything using node-gyp to compile native addons. These stop working until approved.

Caveats

The author flags two limits the summary only gestures at:

  1. The protection degrades into a click-through reflex. Because so many high-download packages need approval, developers will approve repeatedly until it becomes automatic — the same failure pattern as browser/OS permission prompts. His evidence: VSCode disabled the default-on task.allowAutomaticTasks setting in January 2026 (v1.109), yet North Korean threat actors kept exploiting VSCode tasks because developers re-enabled the feature; most large 2026 attacks he's seen still leverage VSCode task/settings files.
  1. Disabling install scripts does not stop the payload where it matters. If a library you already depend on is compromised, the malicious code runs inside your application at runtime — no install script needed. And nothing stops a user from running the package's scripts immediately after install. He also predicts authors with legitimate needs will move build work to places NPM cannot turn off (the post is truncated before naming where).

The --allow-git change specifically closes a bypass that worked even with --ignore-scripts: a git dependency's own .npmrc could override the git executable to achieve code execution.

Organisations named here

  • Liran Tal

Technologies named here

  • npm approve-scripts
  • npm
  • npm approve-scripts --allow-scripts-pending
  • npm deny-scripts
  • VS Code
  • min-release-age
  • minimumReleaseAge
  • npmMinimalAgeGate
  • esbuild
  • Supply Chain Firewall
  • sharp
  • core-js
  • NPQ
  • Puppeteer
  • Socket
  • Nx
  • Aikido
  • Endor Labs
  • utf-8-validate
  • bufferutil
  • bcrypt
  • pnpm
  • Yarn
  • Bun
  • node-gyp

Techniques named here

  • Malicious NPM lifecycle install scripts
  • Git dependency .npmrc bypass
  • Malicious VSCode tasks files
  • Post-install payload relocation
  • Compromised library runtime execution

Threat actors named here

  • North Korean threat actors
  • DPRK

Related in Supply Chain