npm 12 Disables Install Scripts, Git Dependencies, and Remote Tarball URLs by Default to Curb Supply-Chain Worms Like Shai-Hulud — Threadlinqs Intelligence
As of 2026-07-10, npm 12 Disables Install Scripts, Git Dependencies, and Remote Tarball URLs by Default to Curb Supply-Chain Worms Like Shai-Hulud is a medium-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-1163 · Severity: MEDIUM · Status: MITIGATED · Category: SUPPLY_CHAIN
npm 12 flips the default trust model for the JavaScript package ecosystem: dependency lifecycle scripts (preinstall/install/postinstall, implicit node-gyp builds), Git-based dependencies, and remote
GitHub (Microsoft) announced that npm 12, expected to ship in July 2026, changes three long-standing default installation behaviors that have been repeatedly weaponized in npm supply-chain attacks. First, `allowScripts` now defaults to off: dependency lifecycle scripts (`preinstall`, `install`, `postinstall`) and the implicit `node-gyp rebuild` invoked by native-module packages (e.g. sharp, canvas, bcrypt) no longer execute automatically on `npm install` — they require explicit approval. Second, `--allow-git` now defaults to `none`, blocking resolution of Git-sourced dependencies (direct or transitive) unless explicitly allowed. Third, `--allow-remote` now defaults to `none`, blocking resolution of dependencies fetched from remote tarball URLs (e.g. `https://...tar.gz`) unless explicitly allowed.
To restore functionality for legitimate packages, developers run `npm approve-scripts --allow-scripts-pending` to list every package whose install scripts are not yet covered by the allowlist (read-only, does not modify anything), then `npm approve-scripts <pkg>` to approve individual packages (pinned to exact version by default, or by name with `--no-allow-scripts-pin`), or `npm deny-scripts <pkg>` to explicitly block one. The resulting allowlist is committed into `package.json` so CI and other developers inherit the same trust decisions. A migration path exists via npm 11.16.0 (already available), which surfaces warnings and offers a `--strict-allow-scripts` flag to opt in to v12 behavior early; the recommended bulk-migration pattern is `npm install` → `npm approve-scripts --all` → commit, which snapshots current scripts as trusted while blocking any *new* unexpected scripts going forward — this is explicitly a stopgap, not a substitute for per-package review.
This hardening is a direct structural response to the install-script abuse pattern demonstrated at scale by the Shai-Hulud npm worm campaigns. In September 2025, the original Shai-Hulud worm (patient zero: `rxnt-authentication` v0.0.3, published Sept 14 17:58:50 UTC) used malicious `postinstall` scripts to run a bundled payload (`bundle.js`, 3MB+) that deployed TruffleHog to scan for 800+ secret types, harvested npm/GitHub/AWS/GCP tokens, then self-propagated by publishing trojanized new versions of every other package the compromised maintainer controlled — compromising over 400 packages including `@ctrl/tinycolor` (2.2M weekly downloads), `ngx-bootstrap`, and `ng2-file-upload` within roughly 24 hours, and publicly exposing stolen secrets via auto-created GitHub repositories named 'Shai-Hulud'. In November 2025, a more aggressive 'Shai-Hulud 2.0' / 'Sha1-Hulud: The Second Coming' campaign moved the payload from the `postinstall` to the `preinstall` lifecycle hook specifically so the malicious code would execute even if the rest of the package installation subsequently failed — compromising roughly 700 npm packages (including `@postman/tunnel-agent`, `posthog-node`, `posthog-js`, `@asyncapi/specs`), creating over 25,000 malicious GitHub repositories at a peak velocity of ~1,000 new repos per 30 minutes, exfiltrating 775 GitHub tokens, 373 AWS credentials, 300 GCP credentials, and 115 Azure credentials from roughly 500 compromised GitHub users. Both campaigns are attributed with only moderate confidence to a financially- or chaos-motivated actor with no named group; researchers assess with moderate confidence that an LLM was used to help generate the malicious bash scripts (based on comment style and emoji usage in the code).
npm 12 is one plank of a broader npm ecosystem hardening timeline disclosed alongside it: from early August 2026, Granular Access Tokens (GATs) configured to bypass 2FA will lose the ability to perform sensitive account operations (token management, password/email changes, 2FA configuration, package-access changes, organization management); from January 2027, GATs will no longer support direct package publishing at all — publishing will require staged r
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-1357
Target sectors: technology, software-development, all-sectors-using-npm
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, MEDIUM, threat intelligence, cybersecurity, T1586, T1566, T1195, T1059, T1547.013, T1547, T1547.001, T1053, T1078, T1098.001