# Finally some good news

Source: https://www.youtube.com/watch?v=cX3G0cPRJiA
Recap page: https://rapidrecap.app/video/cX3G0cPRJiA
Generated: 2026-06-17T18:01:05.928+00:00

---
## Quick Overview

GitHub is significantly improving npm supply chain security in version 12 by disabling automatic preinstall, install, and postinstall scripts by default. This security update forces developers to explicitly opt-in to these scripts, effectively mitigating risks from malicious packages that leverage post-installation hooks to compromise developer environments and CI/CD pipelines.

**Key Points:**
- GitHub transitions npm to an opt-in model for preinstall, install, and postinstall scripts in version 12.
- The new security measures prevent automatic script execution, which previously served as a primary infection vector for self-propagating malware like the Shai-Hulud worm.
- Developers must now explicitly approve or deny scripts via the package.json configuration to maintain functionality for packages requiring build steps.
- Default behaviors for git dependencies and remote URL resolution are changing to 'none' to prevent unauthorized binary execution and dependency hijacking.
- The update closes a critical security gap where compromised packages could execute malicious code immediately upon installation without user interaction.
- The changes are currently available behind warnings in npm versions 11.16.0 and newer, with a full release scheduled for July 2026.

![Screenshot at 06:01: GitHub announcement details for upcoming npm v12 security-related default changes to npm install scripts.](https://ss.rapidrecap.app/screens/cX3G0cPRJiA/00-06-01.jpg)

**Context:** The Node Package Manager (npm) ecosystem has faced recurring supply chain attacks, most notably the 'Shai-Hulud' worm, which exploited the 'postinstall' script feature to inject malicious code and steal sensitive credentials. These attacks frequently targeted developer machines and automated CI/CD environments, leading to widespread security concerns. GitHub, as the owner of the npm registry, is implementing these breaking changes to address these vulnerabilities and shift from a model that prioritizes convenience to one that emphasizes security by default.

## Detailed Analysis

The npm ecosystem is undergoing a major security transformation with the upcoming release of version 12. Historically, npm packages could automatically execute shell scripts during installation via preinstall, install, and postinstall hooks. Malicious actors exploited this feature to deliver malware, steal credentials, and compromise CI/CD pipelines. To counter this, npm v12 disables these scripts by default, requiring developers to explicitly opt-in via the package.json file. Additionally, npm is tightening controls on git dependencies and remote URL resolutions, defaulting them to 'none' to prevent attackers from overriding system binaries or pulling unauthorized dependencies. These changes, currently available in npm 11.16.0+, represent a significant shift toward 'secure by default' practices, forcing developers to audit their dependencies and only allow necessary scripts to run. While this may require some initial configuration for projects relying on complex build processes, it drastically reduces the attack surface for the entire JavaScript community.

### Security Policy Changes

- Disables automatic execution of preinstall, install, and postinstall scripts
- Requires explicit opt-in via package.json
- Prevents unauthorized code execution during package installation

### Dependency & Infrastructure Hardening

- Git dependencies default to 'none' to prevent binary hijacking
- Remote URL resolution defaults to 'none'
- Prevents attackers from using malicious .npmrc files to override system configuration

### Implementation & Migration

- Available now in npm 11.16.0+ behind warning flags
- Full enforcement scheduled for July 2026
- Encourages developers to audit and whitelist dependencies

![Screenshot at 00:39: Article headline detailing the Shai-Hulud worm compromise of the npm ecosystem](https://ss.rapidrecap.app/screens/cX3G0cPRJiA/00-00-39.jpg)
![Screenshot at 06:18: Configuration options for allowScripts, allowScripts-pending, and allowScripts-denied in package.json](https://ss.rapidrecap.app/screens/cX3G0cPRJiA/00-06-18.jpg)
![Screenshot at 06:44: Default configuration changes for git dependencies and remote URL resolution](https://ss.rapidrecap.app/screens/cX3G0cPRJiA/00-06-44.jpg)
![Screenshot at 09:34: npm's introduction of the minimumReleaseAge setting to delay the installation of newly published packages](https://ss.rapidrecap.app/screens/cX3G0cPRJiA/00-09-34.jpg)