A major update to the popular package manager npm has just been rolled out, with significant implications for developers and users of open-source software. As of July 9th, npm version 12 will no longer execute install scripts by default, a change aimed at reducing the risk of supply chain attacks.
This move comes in response to growing concerns over the potential for malicious actors to exploit vulnerabilities in software dependencies. Install scripts are used to automate various tasks during the installation process, but they can also be leveraged by attackers to inject malware or other malicious code into software projects. By disabling this feature by default, npm is taking a proactive step to mitigate this risk.
The decision to disable install scripts was not taken lightly. According to npm’s blog post announcing the change, the company has been working closely with the open-source security community to identify and address potential vulnerabilities in its ecosystem. By preventing malicious actors from exploiting these vulnerabilities through install scripts, npm is hoping to reduce the likelihood of successful attacks.
The change will undoubtedly have a significant impact on developers who rely on npm for their projects. Those who need to execute install scripts will now be required to explicitly opt-in to this feature using a new flag called `–optional-flags`. This may require some adjustments to existing build processes, but it’s a relatively minor hurdle compared to the potential consequences of a supply chain attack.
The decision to disable install scripts by default also highlights the growing importance of software security in the open-source community. As AI-powered tools become increasingly prevalent in cybersecurity, they are helping to uncover vulnerabilities that might have otherwise gone undetected. However, these tools can only do so much – it’s up to developers and users to take proactive steps to secure their software dependencies.
For users of npm, this change serves as a reminder to regularly review and update their software dependencies. It’s also an opportunity to familiarize themselves with the new `–optional-flags` feature and adjust their build processes accordingly. By taking these simple precautions, developers can significantly reduce their exposure to supply chain attacks and ensure that their software projects remain secure.
Source: The Hacker News — 2026-07-09