npm v12 changes package installation from automatic trust to explicit approval. The standard "just run npm install" model stops being passive, so build and CI workflows that depended on dependency scripts or non-registry sources will break unless policy is updated first.
GitHub says v12 will block dependency preinstall, install, and postinstall scripts unless approved, along with Git-based dependencies and remote URL dependencies such as tarballs. The company says this closes install-time paths that have been used in recent supply-chain attacks and that npm 11.16.0 will warn on actions that will fail under v12.
The shift moves control to developer and CI policy, not the package itself. Teams that treat installs as trusted execution will need to review what their pipelines allow before v12 becomes the default.