TL;DR
npm v12, scheduled for release in July 2026, will introduce default security restrictions that disable automatic script execution and restrict dependency resolution from Git and remote URLs unless explicitly permitted. These changes are currently available behind warnings in npm 11.16.0+.
npm v12, set for release in July 2026, will disable automatic execution of scripts during package installation and restrict resolution of dependencies from Git and remote URLs unless explicitly approved by users, marking a significant shift in npm’s security defaults.
The upcoming npm v12 introduces several default security-related changes that will impact how dependencies are installed and managed. These changes are currently available as warnings in npm version 11.16.0 or newer, allowing developers to prepare for the transition. The most notable change is that npm install will no longer automatically run preinstall, install, or postinstall scripts from dependencies unless explicitly permitted. This includes native node-gyp builds, which will be blocked unless approved via new commands. Additionally, npm will restrict resolving Git dependencies and dependencies from remote URLs unless the user explicitly allows these via command-line flags.
Specifically, the default for allowScripts will be off, requiring users to approve scripts from trusted packages. The command ‘npm approve-scripts –allow-scripts-pending’ can be used to review and approve scripts, with the resulting allowlist stored in package.json. For Git dependencies, the default is now to reject resolution unless ‘–allow-git’ is specified, and similarly, remote URL dependencies will be blocked unless explicitly permitted with ‘–allow-remote.’ These changes aim to improve security by reducing automatic code execution and dependency risks.
Developers are advised to upgrade to npm 11.16.0 or later, run their install routines, and review warnings. They should then approve trusted scripts and dependencies, commit the updated package.json, and prepare for the v12 release. The npm team emphasizes that these defaults will require explicit user action to permit potentially risky operations, aligning with broader security best practices.
Impact of Security Defaults on Dependency Management
The enforced defaults in npm v12 will significantly improve security by preventing automatic script execution and restricting dependency resolution from untrusted sources. This reduces the risk of malicious code running during installations and limits attack vectors through compromised Git or remote dependencies. However, it also places a burden on developers to manually review and approve necessary scripts and dependencies, potentially complicating workflows but ultimately fostering safer package management practices.
JFROG ARTIFACTORY: THE COMPLETE GUIDE TO UNIVERSAL ARTIFACT MANAGEMENT: Binary Repository, Package Management, CI/CD Integration, and DevSecOps for Docker, Maven, NPM, and Python
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Background of npm Security Enhancements
npm has progressively introduced security measures in recent versions, including warnings for scripts and dependency restrictions. The upcoming v12 builds on these efforts by making certain defaults mandatory, reflecting industry-wide emphasis on supply chain security. The changes follow previous announcements made in February 2026, with the current warnings in npm 11.16.0+ serving as a preview for developers to adapt their workflows before the full enforcement in v12.
“The default restrictions in npm v12 will force developers to explicitly approve scripts and dependencies, significantly reducing automatic code execution risks.”
— an anonymous researcher
“Our goal is to improve the security of the npm ecosystem by making potentially risky operations opt-in, not opt-out.”
— npm team representative
Unresolved Aspects of the Transition to npm v12
It is not yet clear how widely developers will adopt the new approval process before the v12 release and whether there will be significant resistance or issues with workflows. The exact timeline for when the default restrictions will fully activate remains to be confirmed, and there may be unforeseen compatibility challenges with existing packages or CI/CD pipelines.
Next Steps for Developers Preparing for npm v12
Developers should upgrade to npm 11.16.0 or later, review warnings about scripts and dependencies, and use the new approval commands to whitelist trusted packages. They should test their workflows thoroughly before the v12 release in July 2026 and monitor npm community discussions for updates or issues. The npm team will likely provide further documentation and guidance as the release date approaches.
Key Questions
When will npm v12 be officially released?
npm v12 is scheduled for release in July 2026, with the new defaults available in beta or preview form since npm 11.16.0+.
How can I prepare my project for these changes?
Upgrade to npm 11.16.0 or later, run your install routines, review warnings, approve trusted scripts and dependencies with ‘npm approve-scripts,’ and commit the updated package.json.
Will existing dependencies break after the default restrictions are enforced?
Dependencies that run scripts or resolve from Git or remote URLs without approval may be blocked unless explicitly permitted, so testing and approval are recommended beforehand.
Are there any exceptions to these new defaults?
Yes, the flags ‘–allow-git,’ ‘–allow-remote,’ ‘–allow-file,’ and ‘–allow-directory’ can override defaults, but they require explicit user action.
What is the main benefit of these security changes?
The primary benefit is reducing the risk of malicious code execution during package installation, strengthening supply chain security in the npm ecosystem.
Source: Hacker News
