ST-2026-013 · SDKs, clients & toolchains
npm v12 makes install scripts, Git dependencies and remote URLs opt-in
npm v12 became generally available on 8 July 2026 with security defaults that stop dependency lifecycle scripts, implicit node-gyp builds, Git dependencies and remote-URL dependencies from running or resolving unless explicitly allowed.
Previous state
npm install automatically ran dependency lifecycle scripts and implicit node-gyp builds and resolved Git or remote-URL dependencies by default.
Current state
npm v12 defaults allowScripts, allow-git and allow-remote to restrictive values, requiring projects to explicitly approve trusted scripts and non-registry dependency sources.
Affected users
Who needs to care
Node.js projects, CI images, package-maintenance tooling and build pipelines that depend on install scripts, native module compilation, Git dependencies or remote tarballs.
Required response
What to do
Run installs on npm 11.16 or later to review warnings, use npm approve-scripts to create a committed allowlist, inventory Git and remote dependencies, and test clean CI builds before adopting npm v12.
Evidence boundary
What the source does not prove
This record covers npm v12 install-time defaults only. The same announcement also begins separate granular-access-token 2FA changes, which require their own authentication-policy analysis.
Lifecycle history
Dated event sequence
- Breaking defaults announced
GitHub described the upcoming v12 behavior and preparation commands available in npm 11.16.0 and later.
- npm v12 generally available
The install-time security defaults became active in the latest major release.
Evidence ledger
First-party sources
- 01GitHub Changelog — Upcoming breaking changes for npm v12
Official advance breaking-change notice · 2026-06-09
Open official source ↗ - 02GitHub Changelog — npm install-time security and GAT bypass2fa deprecation
Official npm v12 activation notice · 2026-07-08
Open official source ↗