{"rewrite":{"id":"r_f95bf0a993d73148c131abd6","clusterId":"c_7142591735d30a0aef383b50","slug":"npm-v12-will-stop-automatic-script-execution-by-default","model":"deepseek-v4-flash","headline":"Npm v12 Will Stop Automatic Script Execution by Default","summary":"GitHub announced that npm v12, due in July 2026, will disable automatic execution of install scripts by default. The change is intended to close a security vector where malicious packages could run arbitrary code during installation. Developers will need to explicitly approve scripts for trusted packages, and Git and remote URL dependencies will also be blocked by default.","whyItMatters":"The change removes a longstanding default behavior in npm that made package installation a potential attack surface, shifting the burden of trust from the package ecosystem to the developer's explicit approval.","webCardHtml":"\u003cp\u003eGitHub plans to ship npm v12 in July 2026 with a major security change: the package manager will no longer run install scripts automatically. In current versions, packages can include preinstall, install, and postinstall scripts that execute without developer review, a mechanism that has been exploited by compromised packages. Under the new default, the allowScripts setting will be off, and scripts will run only for packages explicitly trusted by the project. The implicit node-gyp rebuild for native addons will also be blocked without permission.\u003c/p\u003e\u003cp\u003eGit and remote URL dependencies will be disabled by default as well, closing another path for arbitrary code execution via .npmrc file rewriting. Starting with npm 11.16.0, warnings will appear for packages whose scripts will be restricted in v12. Developers can use npm approve-scripts and npm deny-scripts to manage trust, with the allow/deny list stored in package.json for team sharing.\u003c/p\u003e","blueskyPost":"npm v12, due July 2026, will turn off automatic script execution by default. Preinstall, install, and postinstall scripts will only run for explicitly approved packages. Git and remote URL dependencies will also be blocked by default. Developers can manage trust with npm approve-scripts.","twitterPost":"npm v12, due July 2026, will stop automatic script execution by default. Preinstall, install, and postinstall scripts will only run for explicitly approved packages. Git and remote URL dependencies will also be blocked by default.","threadsPost":null,"newsletterBlurb":"GitHub announced that npm v12 will disable automatic script execution by default, closing a security vector where malicious packages could run arbitrary code during installation. Developers will need to explicitly approve scripts for trusted packages, and Git and remote URL dependencies will also be blocked by default. The change is scheduled for July 2026.","attributionJson":"[{\"source\":\"GIGAZINE\",\"url\":\"https://gigazine.net/news/20260611-npm-install-script/\",\"title\":\"The era of simply running 'npm install' to execute code is ending: npm plans to stop automatic script execution by default\"}]","lintFlagsJson":null,"lintHits":0,"costUsd":0,"inputTokens":4171,"outputTokens":611,"status":"published","repairAttempts":0,"nextRepairAt":null,"factsAttemptedAt":1781148100,"createdAt":"2026-06-11T03:16:25.000Z","publishedAt":"2026-06-11T03:20:33.000Z","updatedAt":"2026-06-11T03:20:33.000Z"},"cluster":{"id":"c_7142591735d30a0aef383b50","canonicalTitle":"「npm install」だけでコードが実行される時代が終了へ、npmが自動スクリプト実行を標準で停止する予定","representativeArticleId":"a_cd857dbce4971df2dbe59b16","sourceCount":1,"writtenSourceCount":1,"writeAttempts":0,"isSolo":true,"entitiesJson":"{\"anime_titles\":[],\"manga_titles\":[],\"work_titles\":[],\"studios\":[],\"people\":[],\"type\":\"news\",\"domain\":\"other\",\"is_roundup\":false}","contentType":"news","status":"published","firstSeenAt":"2026-06-11T02:32:00.000Z","lastSeenAt":"2026-06-11T02:32:00.000Z","updatedAt":"2026-06-11T03:20:33.000Z"},"attribution":[{"source":"GIGAZINE","url":"https://gigazine.net/news/20260611-npm-install-script/","title":"「npm install」だけでコードが実行される時代が終了へ、npmが自動スクリプト実行を標準で停止する予定"}],"entities":{"anime_titles":[],"manga_titles":[],"work_titles":[],"studios":[],"people":[],"type":"news","domain":"other","is_roundup":false},"keyFacts":["npm v12, due in July 2026, will disable automatic execution of install scripts by default.","The change closes a security vector where malicious packages could run arbitrary code during installation.","Developers must explicitly approve scripts for trusted packages using npm approve-scripts and npm deny-scripts.","Git and remote URL dependencies will also be blocked by default in npm v12.","Starting with npm 11.16.0, warnings will appear for packages whose scripts will be restricted in v12."]}