AppSec · 67 days ago

npm v12 Turns Off Install-Time Code by Default

npm v12 cuts off a quiet execution path that dependency malware has used to run before any app code loads. The practical change is that preinstall, install, postinstall, and similar hooks no longer fire automatically unless a user approves them, so many install-time payloads now stop at the gate instead of running on import.

The release also blocks implicit node-gyp rebuilds by default and starts deprecating 2FA-bypass publishing tokens. That closes a gap scanners often miss, since malicious behavior can live in install-time hooks or binding.gyp-driven rebuilds rather than in the package code most reviews inspect.

Timeline

• Jul 9 Reported by The Hacker News
• Jul 8 Reported by Socket.dev

Sources

2 sources covering this story

• The Hacker News Jul 9

  npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk

  GitHub releases npm 12 with install scripts off by default and begins phasing out 2FA bypass tokens for sensitive npm actions.

• Socket.dev Jul 8

  npm v12 Ships With Install Scripts Off by Default, Begins De...

  npm v12 is generally available, turning install scripts off by default and beginning the deprecation of 2FA-bypass publishing tokens.

Part of the PlainSec briefing for 2026-07-09

Editions

• Briefing for 2026-07-09