GitHub's npm Overhaul: No More Automatic Install Scripts

Automatic install script execution in npm will soon become a relic of the past. GitHub has announced that starting in July, npm v12 will block such scripts by default. Developers will need to explicitly permit them for execution. This change, documented in GitHub's changelog, marks a significant shift in npm's behavior. Until now, preinstall, install, and postinstall scripts from dependencies ran automatically, including implicit node-gyp rebuilds.

Sonu Kapoor, who maintains the CVE Lite CLI within the OWASP Incubator Project, believes this adjustment only narrows the attack surface, not eliminates it. "It removes a major automatic execution path," Kapoor noted, "but attackers can still leverage other methods such as malicious package code or dependency confusion."

Alan Parkinson of Threat Detective highlighted that seasoned attackers had already moved past this vulnerability, which was seen as unsophisticated. "Running code from an install hook was always noisy, causing visible damage, drawing attention," Parkinson said.

GitHub's principal engineer, Zach Steindler, remarked that the sheer volume of supply chain attacks necessitated this change. "Secure defaults are essential for widespread adoption," he stated, emphasizing the need for secure paths as the default.

Sanchit Vir Gogia from Greyhound Research pointed out that npm was the last major repository to make this change, following others like Yarn and Bun. "Npm is adopting a well-established doctrine, not inventing one," Gogia added.

The pressure to change also emanated from regulatory shifts. With acts like the EU Cyber Resilience Act, the liability for supply chain failures has shifted to corporate balance sheets. Kapoor acknowledged the compatibility challenges posed by this change, noting that legitimate packages have long used install scripts for various build processes.

Cybersecurity consultant Brian Levine highlighted the impact, stating, "When npm changes its defaults, it alters the security posture of nearly every enterprise development environment."

For developers, the takeaway is clear: review project dependencies and explicitly authorize any that genuinely require script execution. This enhanced transparency should mitigate risks associated with automatic script execution.