npm 12 disables install scripts by default and blocks non-registry dependencies

npm 12 shifts the default for dependency lifecycle scripts from automatic execution to explicit opt-in. The allowScripts setting now defaults to off, meaning preinstall, install, and postinstall scripts will not run unless a developer approves them. This includes implicit node-gyp builds for packages with a binding.gyp file, even when no install script is declared. The change also blocks git and remote tarball dependencies by default, closing code execution paths that could be abused.

Adopting this change costs developers time and attention. Every dependency that relies on lifecycle scripts must be reviewed and added to an allowlist in package.json. Global installs and npx cannot use approve-scripts and require configuration instead, such as setting allow-scripts in user config. There is also a chicken-and-egg problem: npm approve-scripts reads from node_modules, so newly installed packages that need approval will error with ENOMATCH until they are installed.

The new defaults have limitations. An existing ignore-scripts=true setting takes precedence and silently defeats the allowlist, so teams with that configuration may not see the expected protection. Security researchers warn of approval fatigue, as popular packages like esbuild, sharp, core-js, puppeteer, and bcrypt rely on lifecycle scripts. Repeated broken builds could turn deny-by-default into a click-through prompt, pushing attacker activity onto less visible surfaces.

npm is the last major package manager to adopt these controls; pnpm, yarn, and bun already offer similar allowlisting or age gates. Community reaction is broadly supportive, with some developers calling postinstall scripts a long-standing problem. However, legitimate use cases like patch-package are cited as reasons for caution. The change addresses a real threat: JFrog reports that these three vectors were involved in roughly 53% of malicious npm attacks observed in the past year.