npm 12 Tightens Security with Disabled Install Scripts

GitHub has released npm version 12, introducing significant security improvements aimed at reducing supply chain risks in the Node.js ecosystem. By default, the new version disables automatic execution of package install scripts—a common vector for malicious code injection.

In addition to script changes, npm 12 begins the deprecation process for granular access tokens (GATs) that were previously able to bypass two-factor authentication (2FA). These updates reflect ongoing efforts to strengthen developer workflow security and minimize potential exploitation paths.

Install Script Changes

• The allowScripts option now defaults to false, requiring explicit permission to run package scripts during installation.
• This change mitigates the risk of executing unintended or malicious code from third-party packages.
• Developers can re-enable scripts on a per-project basis using the --allow-scripts CLI flag.
• Projects relying on automated script execution will need configuration updates to maintain functionality.

Authentication Security Improvements

• Granular Access Tokens (GATs), which previously could circumvent 2FA enforcement, are now deprecated.
• This move strengthens account protection by ensuring 2FA remains effective across all token types.
• Organizations should audit existing tokens and transition to supported authentication methods.
• Future npm versions will fully remove support for legacy GAT behavior.

Sources

• npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk