Package installs just stopped trusting your scripts. npm 12, out august 14, turns install-script…
package installs just stopped trusting your scripts. npm 12, out august 14, turns install-script execution off by default and restricts non-registry sources, so every build script needs explicit approval.
supply chain safety finally became the default.
Context
The npm CLI v12.0.0 GitHub release was published on 2026-07-08 and the npm docs changelog lists 12.0.0 on 2026-07-08. GitHub's changelog of June 9, 2026 on upcoming breaking changes says dependency lifecycle scripts are blocked by default unless allowed by the root package's allowScripts policy, covering preinstall, install and postinstall of dependencies including implicit node-gyp rebuild, with git, file and link dependencies' prepare scripts blocked the same way. It says --allow-git and --allow-remote default to none, and that the --allow-file and --allow-directory defaults are not changing. The v12.0.0 release also says root preinstall now runs before dependencies are installed, and lists removed commands including npm shrinkwrap and npm adduser.
Out august 14 matches the date of an InfoQ article and not the first-party release, which is July 8, 2026. The blocked scripts are dependency lifecycle scripts, so every build script needs explicit approval overstates it, and the project's own root scripts are not listed as blocked. Non-registry restriction is supported for git and remote URL sources and not for file or directory sources. The June 9 changelog names npm approve-scripts and npm deny-scripts, while the release text says npm install-scripts approve, and the two command names were not reconciled. No measured security outcomes were read.
Related work
- pnpm 12 note ↗A different package manager covering the same script-safety topic.
Watch next
- Which approval command name is current.
Sources
- npm CLI v12.0.0 release (July 8, 2026)github.com
- GitHub changelog: upcoming breaking changes for npm v12 (June 9, 2026)github.blog
- npm docs: CLI v12 changelogdocs.npmjs.com
- InfoQ: npm 12 released (August 14, 2026)infoq.com
Provenance
The note above is reproduced unedited from the original post, first published on Threads on 22 September 2026 at 08:33 IST. Sources are the papers and datasets the note draws on.
View the original post ↗Embed this note
More notes
The air is now being asked to keep its own ledger
the air is now being asked to keep its own ledger: ecmwf’s aifs compo becomes the first ai model to forecast atmospheric composition globally every three hours, cleanair simulates 365 days of pm2.5 over china in ten seconds, and a unified framework maps six pollutants at one kilometer across the whole country. the air now files its own composition report.
read the note →The current is now being asked to draw its own map
the current is now being asked to draw its own map: china’s langya 2.0 predicts six ocean phenomena including internal waves and mesoscale eddies, a deep net called wenhai resolves eddies globally with air sea flux formulas built in, and scripps infers surface currents from the way temperature patterns deform in satellite images. the ocean now files its own circulation report.
read the note →The soil is now being asked to report its own carbon
the soil is now being asked to report its own carbon: a nix color sensor paired with generative data augmentation predicts soil organic carbon without a lab, random forest drives 74 percent of soil health mapping studies, and sentinel 2 tracks five year carbon change across france and italy from 922 samples. the dirt now files its own carbon account.
read the note →