npm v12 disables automatic installation scripts

// 52d agoPRODUCT UPDATE

npm v12 disables automatic installation scripts

The upcoming npm v12 release in July 2026 will disable automatic installation scripts, Git dependencies, and remote tarball URLs by default to secure the JavaScript supply chain. Developers must explicitly whitelist trusted dependency scripts using a new approve-scripts command that saves an allowlist to package.json.

// ANALYSIS

While disabling implicit code execution during package installation is a massive step forward for supply chain security, this shift will cause widespread friction and build failures.

* Restricting dependency scripts by default will break a huge number of popular packages that rely on native compilation, shifting the burden of trust auditing to individual developers.

* The strict Git and remote URL restrictions will force changes in enterprise CI/CD environments and private dependency management workflows.

* There is a high risk of approval fatigue, where developers simply run `npm approve-scripts` to bypass warnings and unblock their workflow without actually auditing the dependencies.

// TAGS

npmjavascriptnodejssecuritypackage-manager

DISCOVERED

52d ago

2026-06-10

PUBLISHED

52d ago

2026-06-09

RELEVANCE

8/ 10

AUTHOR

plasma

// KEEP READING

More AI developer news from the feed

EXPLORE FULL FEED

RESEARCH1h ago

MANTA enables dynamic topology adaptation for multi-agent systems

MANTA (Multi-Agent Network Topology Adaptation) is a research framework that allows multi-agent LLM systems to dynamically reconfigure their communication topologies at inference time. By combining trace auditing with verbal playbooks during execution, it enables agent teams to optimize collaboration efficiency and achieve superior results on complex benchmarks such as PlanCraft.

NEWS1h ago

Sanseviero highlights persistent workspace challenges in Claude Code

Omar Sanseviero highlighted critical pain points in long-lived Claude Code agent team workflows, where closing terminal sessions destroys active workspace context. Additionally, automatic context compaction blurs granular execution details across individual agents, hindering extended multi-agent development sessions.

OPEN SOURCE3h ago

OpenWorker launches open-source autonomous desktop agent

OpenWorker is an open-source, local-first autonomous desktop co-worker that operates across local documents, terminal commands, and over 25 third-party integrations. Built to execute end-to-end workflows such as file generation and application updates, OpenWorker supports scheduled recurring background jobs while enforcing explicit human approval for high-consequence actions.

npm v12 disables automatic installation scripts