GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks

Summary: GitHub announced breaking changes for npm version 12, scheduled for release next month, that turn off install scripts by default so that code execution during 'npm install' requires explicit user approval. GitHub called install-time lifecycle scripts the 'single largest code-execution surface in the npm ecosystem,' noting that the command runs scripts from every transitive dependency, and the changes also block native node-gyp builds without an explicit install script, prepare scripts from git, file, and link dependencies, and default --allow-git to none.
What's compelling: A single compromised package anywhere in the dependency tree can currently run arbitrary code on a developer machine or CI runner, and anything developers leave unapproved will stop running once they upgrade.

Read the original at The Hacker News ↗

Topics: Supply Chain & AppSec
Related: Kitesurf is now open source Cyber Risks · Nov 13, 2026
Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026
ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026