GitHub's npm v12 will block install scripts and Git dependencies by default in July

GitHub will block dependency install scripts and Git-sourced packages from running by default in npm v12, a set of breaking changes due in July 2026 that targets one of the most common paths attackers use to poison the JavaScript supply chain.

GitHub announced the changes on June 9, 2026 in the npm changelog, outlining three security-focused defaults. Install scripts — the preinstall, install and postinstall hooks that a dependency can run automatically — will no longer execute unless a developer explicitly approves them, a change that also blocks node-gyp native builds and prepare scripts from Git, local and linked dependencies. Separately, npm install will stop fetching Git repository dependencies, whether direct or transitive, without explicit permission via --allow-git, and remote URL dependencies delivered as HTTPS tarballs will require the same opt-in via --allow-remote.

The move matters because install scripts are precisely the mechanism that turns a malicious package into code execution on a developer's machine the moment it is installed. The new defaults target the install-script path behind recent npm supply-chain campaigns, closing it by default rather than relying on developers to vet every dependency.

The changes are not live yet, and they are breaking by design: projects that rely on install scripts or Git dependencies will need to update their workflows. To ease the transition, npm v11.16.0 now surfaces deprecation warnings for the affected behaviors so developers can audit their dependency trees before upgrading.

The shift lands as supply-chain attacks against open-source registries accelerate, and it pushes npm toward a default-deny posture that other package managers may feel pressure to match.