npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk

Summary: GitHub released npm version 12 with install scripts disabled by default, making previously automatic npm install behaviors opt-in, and deprecated granular access tokens (GATs) designed to bypass two-factor authentication. Users must now run "npm approve-scripts --allow-scripts-pending" and commit the resulting allowlist in package.json, with one change taking effect in early August 2026 and another scheduled for January 2027.
Key Takeaway: Every dependency that ran code automatically at install now needs explicit approval, and GitHub is telling teams to move automated publishing to trusted publishing (OIDC) or staged publishing with a human approval step rather than a long-lived publish token before the 2026 and 2027 deadlines.

Read the original at The Hacker News ↗