GitHub is overhauling npm with version 12, flipping three long-standing permissive defaults to fight software supply chain attacks. Starting July 2026, npm will block install scripts, Git dependencies and remote URL packages by default — all requiring explicit developer opt-in. Upgrade to npm 11.16.0 now to preview, then run the new npm approve-scripts command to see which of your dependencies will break and build an allowlist before the deadline.
Security experts are cautiously supportive. Semgrep's Isaac Evans praised the structural approach but warned attackers will pivot to the next trusted layer, naming Artifactory and Nexus. Researcher Paul McCarty welcomed closing the defaults but fears developers will "simply blind-approve blocked scripts" to get builds working, since "this builds" always wins — which would leave the security benefit on paper only.
Source: Infosecurity Magazine