npm 12 Pulls the Plug on Install Scripts by Default

GitHub says npm version 12 will ship a pile of breaking changes, and the headline one is overdue: install scripts will be off by default.

That single flip kneecaps the most reliable trick in the modern supply chain attacker's playbook. You know the one. A typosquatted or compromised package lands on a developer's machine, npm install runs, and a preinstall or postinstall hook quietly fires off a credential stealer before anyone has imported a single line of code.

It's the JavaScript ecosystem's version of autorun.inf. And it's been abused accordingly.

The lifecycle hook problem is not theoretical. The Shai-Hulud worm that ripped through npm earlier this year used postinstall scripts to self-propagate, harvesting tokens and republishing trojanized packages under any maintainer credentials it found. Earlier incidents — the event-stream compromise, the ua-parser-js hijack, the endless drip of typosquats targeting @types/* and crypto wallets — all leaned on the same primitive. Install a package, run arbitrary code, game over.

Under the new default, those scripts simply won't execute when you run npm install. Developers who actually need them — and there are legitimate cases, like native module compilation via node-gyp — will have to opt in explicitly, package by package or via configuration.

If this sounds familiar to anyone who's worked in other ecosystems, it should. Python's pip has been wrestling with the same shape of problem around setup.py execution for years, and the broader industry has been slowly moving toward declarative, non-executable package manifests. npm is catching up.

The practical fallout for shops running CI pipelines is worth flagging now rather than during the upgrade. Anything depending on a postinstall step to download binaries, patch files, or fetch credentials at install time will break. That includes a non-trivial number of internal tools, plus some popular packages like puppeteer and cypress that historically grabbed browser binaries via postinstall hooks. Most of those projects have already moved to lazy-download patterns, but not all.

The other breaking changes in npm 12 are less dramatic but worth tracking. GitHub has laid them out in its npm roadmap on the official repo, and security teams will want to map their internal package policies against the list before the cutover.

Is this a silver bullet? No. Attackers will pivot to import-time payloads, malicious build plugins, and the old standby of just compromising a real maintainer's account. Phishing npm credentials still works. Stolen 2FA tokens still work.

But closing the install-script door means the cost of a successful typosquat goes up. The blast radius shrinks. A developer who runs npm install evil-package and then never imports it is no longer automatically owned.

That's a meaningful change. It should have happened years ago.