{"id":1264,"date":"2026-06-11T07:37:21","date_gmt":"2026-06-11T07:37:21","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1264"},"modified":"2026-06-11T07:37:21","modified_gmt":"2026-06-11T07:37:21","slug":"github-to-disable-npm-install-scripts-by-default-to-stop-supply-chain-attacks","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1264","title":{"rendered":"GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Jun 11, 2026<\/span><\/span>Developer Security \/ Software Supply Chain<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

GitHub has announced<\/a> what it said are \u00abbreaking changes\u00bb coming to npm version 12, one of which turns off install scripts by default to combat software supply chain threats.<\/p>\n

The changes aim to combat attack techniques that abuse the \u00abnpm install\u00bb command to trigger the execution of malicious code using npm lifecycle hooks. \u00abNpm install\u00bb is used to download and install all the necessary dependencies for a Node.js project. Version 12 is scheduled for release next month.<\/p>\n

Describing install-time lifecycle scripts as the \u00absingle largest code-execution surface in the npm ecosystem,\u00bb GitHub said<\/a> the \u00abnpm install\u00bb command runs scripts from every transitive dependency, as a result of which a single compromised package anywhere in the dependency tree can run arbitrary code on a developer machine or CI runner.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

By blocking such behaviours, the idea is to require explicit user approval before code execution is initiated automatically during \u00abnpm install\u00bb as opposed to being trusted by default. \u00abMaking script execution opt-in closes that path while keeping it one command away for the packages you trust,\u00bb GitHub said.<\/p>\n

The changes are listed below –<\/p>\n