Back to Devoured - June 15, 2026
DEVOURED
GitHub pulls pin on npm's auto-run scripts

GitHub pulls pin on npm's auto-run scripts

DevOps securitynpm The Register
GitHub will disable automatic install-time scripts in npm 12 by default to mitigate common supply chain attack vectors.
What: In npm 12, scheduled for July 2026, the preinstall, install, and postinstall scripts will require explicit allowlist permission, and remote dependency fetching will be restricted by default to combat malicious activity like the Shai-Hulud worm.
Why it matters: The ecosystem is finally abandoning the dangerous legacy behavior of executing arbitrary code on developer machines during package installation, aligning npm with pnpm, Bun, and Deno.
Takeaway: Audit your project's package.json dependencies now and identify any tools like Playwright or Electron that rely on install scripts so you can permit them before the upgrade to version 12.
Deep dive
  • Disables automatic execution of install-time scripts by default.
  • Restricts Git-based and remote URL dependency fetching unless explicitly enabled.
  • Requires use of an allowlist for packages that rely on native modules or binary downloads.
  • Replaces the advisory nature of flags with enforced security defaults.
  • Introduces protection against Shai-Hulud-style malware infections.
Decoder
  • Supply chain attack: A cyberattack that targets a software's source by injecting malicious code into upstream dependencies or build tools.
  • Transitive dependency: A dependency that a project's direct dependency requires to function, creating a deep tree of external code.
Original article

GitHub pulls pin on npm's auto-run scripts

GitHub will change npm's defaults so the install command no longer runs scripts automatically, disabling a feature commonly exploited by malicious packages such as the notorious Shai-Hulud worm.

Maintainer Leo Balter said: "Install-time lifecycle scripts are the single largest code-execution surface in the npm ecosystem. Every npm install runs scripts from every transitive dependency, so a single compromised package anywhere in your tree can execute arbitrary code on a developer machine or CI (continuous integration) runner."

In npm 12, due July, three security-focused defaults are changing. Scripts configured for preinstall, install, or postinstall will no longer run unless explicitly permitted via allow-scripts. The --allow-git flag, which pulls dependencies from remote URLs, will default to off, closing an attack path where a malicious .npmrc file could override the Git executable and achieve arbitrary code execution. Finally, allow-remote will default to none, blocking dependency downloads from remote URLs entirely.

It will still be possible to allow scripts to run via an allowlist in the package.json configuration file. This will be pinned to the installed version of a package by default.

These are breaking changes, and Balter recommended developers run the commands to allow scripts for every currently installed package in a project that requires them. "This gets you protected against new, unexpected scripts immediately," he said. The next step is to review these packages and deny scripts for those where they are not needed.

Some packages require script approval to function, including native modules that compile on install, testing tools like Playwright and Puppeteer (which fetch binaries via postinstall), and Electron, which wraps the Chromium browser engine for cross-platform desktop applications.

These features have been available since npm version 11.10.0, released in February, but as opt-in flags rather than defaults. That version also introduced min-release-age, which blocks installation of package version newer than a specified number of days, designed as a safeguard against newly published malicious packages.

Best security practice for developers using npm 11.16, the current version, is to set these flags on in .npmrc or via environment variables, which will also prepare a project for the changes in version 12. One annoyance is that the existing flag ignore-scripts does not support an allowlist, other than via an additional tool. The ignore-scripts setting will override allow-scripts, so developers will need to remove it, if set to true, to enable approved scripts to run. The allowScripts setting exists in npm 11 but is advisory only.

Will this fix npm security issues? Unfortunately not. "Now all the malware can move from the install script to the module itself where it will inevitably still be run," said one developer. Another common view is that developers should use pnpm, which already has safer defaults than npm, including a minimum release age.

There is consensus, though, that these changes do improve npm security and are long overdue. The pull request for this change includes the remark that "npm is the only remaining major package manager that runs dependency install scripts by default. pnpm v10+, Yarn Berry, Bun, and Deno all block them."

Explore all 71 articles in today's digest

Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi