What changed in npm v12 regarding install scripts?

Starting in July 2026, npm v12 disables the automatic execution of preinstall, install, and postinstall scripts by default. Developers must now explicitly approve scripts to run.

Why did GitHub disable npm install scripts?

The change aims to stop random code execution during package installation, which is a common vector for software supply chain attacks and malicious payload delivery.

How do I fix broken native module builds in npm v12?

You must explicitly approve the scripts for packages that require compilation. Use the new npm approve-scripts command or pass the appropriate opt-in flags in your CI/CD pipeline.

npm v12 Disables Install Scripts by Default to Fight Supply Chain Attacks

Starting in July 2026, GitHub’s npm v12 will disable the automatic execution of install scripts by default. This is the single biggest shift in Node.js package management security in years. If your CI/CD pipeline or local setup relies on postinstall or preinstall scripts, your builds are about to break.

Why npm v12 Is Killing Install Scripts

The goal is simple: stop random code execution during npm install. Recent supply chain attacks have weaponized these scripts. Malicious packages silently execute payloads the moment they are downloaded. This change directly neutralizes the attack vectors behind recent npm worms like Miasma and IronWorm. By making script execution opt-in, npm forces developers to explicitly approve what runs on their machines.

What Breaks and How to Fix It

Native modules that require compilation (like those using node-gyp or binding.gyp) will fail to build out of the box. Here is how to adapt your workflow:

Audit your dependencies: Run npm ls to find packages relying on install scripts.
Opt-in locally: Use the new npm approve-scripts command to allow specific packages to run their setup routines.
Update CI/CD pipelines: Add --ignore-scripts=false or the new approval flags to your build scripts to prevent silent failures.

The Broader Impact on Dev Workflows

This is not just a security patch; it is a fundamental change in developer experience. Teams must now treat package installation as a privileged operation. While this adds a minor friction step, it prevents the silent poisoning of developer environments that has plagued the ecosystem. As we saw with the AsyncAPI Miasma supply chain attack, assuming all packages are safe is no longer a viable strategy.

Wrapping Up

The era of silent, automatic script execution in npm is over. Audit your dependencies today and update your CI/CD pipelines before the v12 rollout hits your environments.