Back Ground.News

GitHub pulls pin on npm's auto-run scripts

Ground.News • June 11, 2026

GitHub has announced that npm v12, expected month, will introduce several security-focused changes aimed at blocking supply-chain attacks abusing behaviors triggered by the 'npm install' command.

GitHub will change npm's defaults so the install command no longer runs scripts automatically, disabling a feature commonly exploited by malicious packages such as the notorious Shai-Hulud worm. Maintainer Leo Balter said: "Install-time lifecycle scripts are the single largest code-execution surface in the npm ecosystem. Every npm install runs scripts from every transitive dependency, so a single compromised package anywhere in your tree can exe…

GitHub has announced what it said are "breaking changes" coming to npm version 12, one of which turns off install scripts by default to combat software supply chain threats. The changes aim to combat attack techniques that abuse the "npm install" command to trigger the execution of malicious code using npm lifecycle hooks. "Npm install" is used to download and install all the necessary

In response to supply chain worm attacks, GitHub announced that NPM v12 will no longer automatically execute dependency installation scripts.

The ability for attackers to leverage automatic install script execution in npm will finally come to an end when expected changes arrive from GitHub in July. Coders will still be able to enable the function, but the default setting will block it. In V12, default settings are changing, GitHub said in its changelog, noting, “it turns an npm install behavior that runs automatically today into one you explicitly opt into.” Specifically, the post s…

GitHub has decided to pull the plug on a long-criticized behavior in npm. Starting with version 12, expected in July 2026, the install command will no longer run preinstall, install, or postinstall scripts from dependencies by default. The change directly targets a vector attackers have exploited with growing success in recent supply-chain incidents. Developers have known the risks for years. A single compromised package could execute arbitrary …

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GitHub to Disable Automatic npm Script Execution to Combat Supply Chain Attacks GitHub announced that npm v12, set for release in July 2026, will change default settings to enhance security by disabling automatic execution of installation scripts from dependencies. This change aims to mitigate supply chain attacks that exploit the npm install command, which has been a significant attack vector for malicious code execution. Attackers have previously leveraged this feature to execute harmful scripts during package installations, leading to incidents like the Shai-Hulud worm. The new version will require explicit approval for scripts to run, significantly narrowing the risk surface. Developers will need to review their dependencies and approve scripts manually to maintain functionality. While this change is a step forward, experts warn that attackers may shift to other methods, such as malicious package code or compromised maintainer accounts. The npm ecosystem, which includes numerous direct and indirect dependencies, remains vulnerable to various attack vectors despite this update. GitHub's decision follows years of escalating supply chain attacks and aims to enhance security in the Node.js environment. 25 sources 61

Extracted Entities

GitHub pulls pin on npm's auto-run scripts

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)

Tools (1)