For as long as npm has existed, installing a package has meant letting it run code on your machine. With npm 12, released on July 8, 2026, that stops being the default.

What changed

The GitHub changelog lists the headline changes:

  • Install scripts are off for dependencies. preinstall, install and postinstall scripts in your dependencies, and implicit native builds through node-gyp, don’t run unless you allow them. Your own project’s scripts still run.
  • Git and remote dependencies need opting into. --allow-git and --allow-remote now default to none, so a dependency pointing at a Git repository or a tarball URL won’t resolve until you say so.
  • Skips warn, they don’t fail. A blocked script prints a warning. If you’d rather CI fail loudly, turn on strict-allow-scripts.

To approve the packages that genuinely need a build step, run npm approve-scripts and commit the resulting allowlist, so the whole team and CI share the same decisions. The new behaviour was available behind warnings from npm 11.16.0, so some teams will already have seen the messages.

The token changes

The second half of the release targets publishing. Granular access tokens that are allowed to bypass two-factor authentication are being wound down in two steps:

  1. Early August 2026: they lose sensitive account, package and organisation actions.
  2. Around January 2027: they lose direct publishing. They can still stage a release, but a human has to approve it with 2FA.

If your release automation still uses one of these tokens, the move to trusted publishing (OIDC from your CI provider) now has a deadline.

Why now

Most of the npm worms of 2025 and 2026 got their first foothold through an install-time script: install a poisoned package and its preinstall hook ran immediately. Blocking that by default closes the single most common door.

It is not a complete fix, and Socket was candid about it: neither script blocking nor OIDC publishing stops an attacker who has taken over a maintainer’s account or CI pipeline. Both kinds of attack happened this year. Attackers have also already experimented with getting code to run through native build files instead of scripts.

What to do

  • Upgrade, then run a clean install in a branch and read the warnings. They tell you exactly which dependencies wanted to run scripts.
  • Approve deliberately. Packages with native modules (image processing, database drivers, some bundlers) usually need approval. A pure-JavaScript utility asking to run a script is worth a second look.
  • Turn on strict-allow-scripts in CI once your allowlist is stable.
  • Check your publishing tokens before January.

Socket reports the npm team hopes to bring v12 to the Node 24 and 26 release lines; that depends on Node’s release team and wasn’t confirmed at launch.

Sources

  1. GitHub Changelog: npm install-time security and 2FA-bypass token deprecation (Jul 8, 2026)
  2. Socket: npm 12 (Jul 8, 2026)

We link every claim to the reporting or official statement it comes from. Where a detail rests on one outlet’s reporting, we say so. Spotted an error? Reply to any newsletter and we’ll correct it.