npm v12 Security Overhaul Blocks Install Scripts by Default: July Deadline for CI Migration

▤ Summary

npm is shipping a major security overhaul in v12 that blocks install scripts, Git dependencies, and remote URL sources by default. Teams using npm in CI/CD need to prepare before the July release or risk broken builds. The article explains that npm 11.16.0 already shows warnings so teams can review and approve required scripts in advance. It also outlines migration steps, including using npm approve-scripts, committing allowlists to source control, and moving internal dependencies to proper registries. The change responds to supply chain attacks and aims to reduce automatic code execution during package installation.

▦ Linked Companies