News

GitHub - the Microsoft-owned code hosting service - has announced a set of “breaking changes” that will ship with npm version 12, due next month. The most significant change will turn off execution of install-time scripts by default, a move intended to reduce the risk of software supply chain compromises.

Currently, the npm install command fetches and installs a project’s dependency tree and runs lifecycle hooks that can execute code during installation. Attackers have exploited that behavior by inserting malicious scripts into packages or transitive dependencies so that a single compromised module can run arbitrary commands on a developer workstation or a continuous integration (CI) runner. GitHub called these install-time lifecycle scripts the largest single code-execution surface in the npm ecosystem.

To close that vector, npm v12 will require explicit permission before running scripts discovered during installation. The core behavioral changes are:

• npm install will no longer automatically run dependency preinstall, install, or postinstall scripts unless those scripts are explicitly permitted by the project
• npm install will not resolve Git-based dependencies (whether direct or transitive) unless the project opts in with --allow-git
• npm install will refuse to resolve dependencies served from remote URLs (for example, https tarballs) unless --allow-remote is provided

GitHub noted that this blocking extends to implicit builds as well - for example, packages that trigger an implicit node-gyp rebuild because they include a binding.gyp file will also be prevented from running unless allowed. Prepare scripts originating from git, file, or link dependencies are likewise blocked under the new defaults.

By setting the default for --allow-git to “none,” the change also seals off a dangerous path where a dependency’s .npmrc could alter how the Git executable is invoked - a vector that could still have been abused even when developers used –ignore-scripts (the flag that prevents package-defined lifecycle scripts from running automatically during installation).

GitHub urges developers to get ready by upgrading to npm 11.16.0 or later, running a normal install, and examining the warnings that npm surfaces. The company recommends using npm approve-scripts --allow-scripts-pending to list packages that contain scripts, approve the ones you trust, and commit the resulting package.json. After moving to the new defaults, only scripts you have explicitly approved will continue to run; any unapproved scripts will be blocked.