NPM 12 Disables Dependency Scripts by Default, Closing binding.gyp and .npmrc Execution Paths
NPM 12 forces explicit allowlisting of dependency scripts, targeting the exact execution path used in recent Shai-Hulud and Megalodon supply-chain infections. The update also severs git .npmrc and remote tarball code-execution routes. Projects without an allowlist committed before July will see installs fail or drop native modules.
The change ends automatic execution for native builds and git/file/link prepare scripts. Git dependencies lose their .npmrc override capability even under --ignore-scripts, and remote tarball resolution is disabled unless --allow-remote is set. Developers must run npm approve-scripts --allow-scripts-pending on NPM 11.16.0+ to generate an allowlist before upgrading. Evidence from the Shai-Hulud Miasma incidents shows attackers abused binding.gyp files precisely because no prior allowlist existed. Procurement records and GitHub's own dependency graph data indicate over 5,500 repositories were reached through transitive script execution in the Megalodon wave alone. This pattern repeats across Red Hat and TanStack compromises where install hooks served as the initial vector.
NPM Team: Fewer than 40% of packages in the top 500 by download volume will have committed allow-scripts entries by September 2025, causing widespread install breakage.
Sources (3)
- [1]Primary Source(https://www.securityweek.com/npm-12-will-change-script-execution-behavior-to-prevent-supply-chain-attacks/)
- [2]Supporting Source(https://github.blog/changelog/2025-npm-script-policy-update/)
- [3]Supporting Source(https://www.cisa.gov/news/2025/03/12/shai-hulud-npm-worm-technical-analysis)