GitHub's npm Gets Security Overhaul to Block Supply Chain Attacks

GitHub's npm v12 enhances security by blocking install scripts, Git dependencies, and remote URL packages by default from July 2026.

By Content Team

Jun 12, 2026

ON THIS PAGE

GitHub is overhauling npm with version 12, flipping three long-standing permissive defaults to fight software supply chain attacks. Starting July 2026, npm will block install scripts, Git dependencies and remote URL packages by default — all requiring explicit developer opt-in. Upgrade to npm 11.16.0 now to preview, then run the new npm approve-scripts command to see which of your dependencies will break and build an allowlist before the deadline.

Security experts are cautiously supportive. Semgrep's Isaac Evans praised the structural approach but warned attackers will pivot to the next trusted layer, naming Artifactory and Nexus. Researcher Paul McCarty welcomed closing the defaults but fears developers will "simply blind-approve blocked scripts" to get builds working, since "this builds" always wins — which would leave the security benefit on paper only.

Source: Infosecurity Magazine

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?