# npm 12 Disables Install Scripts, Git Dependencies, and Remote Tarball URLs by Default to Curb Supply-Chain Worms Like Shai-Hulud

> npm 12 flips the default trust model for the JavaScript package ecosystem: dependency lifecycle scripts (preinstall/install/postinstall, implicit node-gyp builds), Git-based dependencies, and remote tarball URL dependencies are now opt-in rather than automatic, requiring developers to explicitly allowlist trusted packages via 'npm approve-scripts'. The change directly targets the code-execution-at-install vector abused by self-propagating worms such as Shai-Hulud and Shai-Hulud 2.0, which used postinstall/preinstall hooks to harvest and exfiltrate hundreds of thousands of cloud and CI/CD credentials in 2025.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1163
- **ID:** TL-2026-1163
- **Severity:** MEDIUM
- **Category:** SUPPLY_CHAIN
- **Status:** MITIGATED
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

GitHub (Microsoft) announced that npm 12, expected to ship in July 2026, changes three long-standing default installation behaviors that have been repeatedly weaponized in npm supply-chain attacks. First, `allowScripts` now defaults to off: dependency lifecycle scripts (`preinstall`, `install`, `postinstall`) and the implicit `node-gyp rebuild` invoked by native-module packages (e.g. sharp, canvas, bcrypt) no longer execute automatically on `npm install` — they require explicit approval. Second, `--allow-git` now defaults to `none`, blocking resolution of Git-sourced dependencies (direct or transitive) unless explicitly allowed. Third, `--allow-remote` now defaults to `none`, blocking resolution of dependencies fetched from remote tarball URLs (e.g. `https://...tar.gz`) unless explicitly allowed.

To restore functionality for legitimate packages, developers run `npm approve-scripts --allow-scripts-pending` to list every package whose install scripts are not yet covered by the allowlist (read-only, does not modify anything), then `npm approve-scripts <pkg>` to approve individual packages (pinned to exact version by default, or by name with `--no-allow-scripts-pin`), or `npm deny-scripts <pkg>` to explicitly block one. The resulting allowlist is committed into `package.json` so CI and other developers inherit the same trust decisions. A migration path exists via npm 11.16.0 (already available), which surfaces warnings and offers a `--strict-allow-scripts` flag to opt in to v12 behavior early; the recommended bulk-migration pattern is `npm install` → `npm approve-scripts --all` → commit, which snapshots current scripts as trusted while blocking any *new* unexpected scripts going forward — this is explicitly a stopgap, not a substitute for per-package review.

This hardening is a direct structural response to the install-script abuse pattern demonstrated at scale by the Shai-Hulud npm worm campaigns. In September 2025, the original Shai-Hulud worm (patient zero: `rxnt-authentication` v0.0.3, published Sept 14 17:58:50 UTC) used malicious `postinstall` scripts to run a bundled payload (`bundle.js`, 3MB+) that deployed TruffleHog to scan for 800+ secret types, harvested npm/GitHub/AWS/GCP tokens, then self-propagated by publishing trojanized new versions of every other package the compromised maintainer controlled — compromising over 400 packages including `@ctrl/tinycolor` (2.2M weekly downloads), `ngx-bootstrap`, and `ng2-file-upload` within roughly 24 hours, and publicly exposing stolen secrets via auto-created GitHub repositories named 'Shai-Hulud'. In November 2025, a more aggressive 'Shai-Hulud 2.0' / 'Sha1-Hulud: The Second Coming' campaign moved the payload from the `postinstall` to the `preinstall` lifecycle hook specifically so the malicious code would execute even if the rest of the package installation subsequently failed — compromising roughly 700 npm packages (including `@postman/tunnel-agent`, `posthog-node`, `posthog-js`, `@asyncapi/specs`), creating over 25,000 malicious GitHub repositories at a peak velocity of ~1,000 new repos per 30 minutes, exfiltrating 775 GitHub tokens, 373 AWS credentials, 300 GCP credentials, and 115 Azure credentials from roughly 500 compromised GitHub users. Both campaigns are attributed with only moderate confidence to a financially- or chaos-motivated actor with no named group; researchers assess with moderate confidence that an LLM was used to help generate the malicious bash scripts (based on comment style and emoji usage in the code).

npm 12 is one plank of a broader npm ecosystem hardening timeline disclosed alongside it: from early August 2026, Granular Access Tokens (GATs) configured to bypass 2FA will lose the ability to perform sensitive account operations (token management, password/email changes, 2FA configuration, package-access changes, organization management); from January 2027, GATs will no longer support direct package publishing at all — publishing will require staged releases pending human 2FA approval. Separately, the competing package manager pnpm shipped version 11.10 with a new `_auth` registry-authentication setting designed to stop malicious project files from redirecting a developer's valid registry token to an attacker-controlled host — a related but independently-shipped mitigation for token-theft-via-redirect, not part of the npm 12 change itself. No CVE was assigned to this change; it is a default-behavior hardening announcement, not a vulnerability disclosure, and the source article names no active exploitation of npm 12 itself (npm 12 is the fix, not the flaw).

## MITRE ATT&CK

- T1586 Compromise Accounts
- T1566 Phishing
- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1547.013 XDG Autostart Entries
- T1547 Boot or Logon Autostart Execution
- T1547.001 Registry Run Keys / Startup Folder
- T1053 Scheduled Task/Job
- T1078 Valid Accounts
- T1098.001 Additional Cloud Credentials
- T1027 Obfuscated Files or Information
- T1557 Adversary-in-the-Middle
- T1110 Brute Force
- T1552 Unsecured Credentials
- T1552.001 Credentials In Files
- T1555.003 Credentials from Web Browsers
- T1555 Credentials from Password Stores
- T1528 Steal Application Access Token
- T1087 Account Discovery
- T1580 Cloud Infrastructure Discovery
- T1526 Cloud Service Discovery
- T1619 Cloud Storage Object Discovery
- T1021.004 SSH
- T1021.006 Windows Remote Management
- T1005 Data from Local System
- T1020 Automated Exfiltration
- T1537 Transfer Data to Cloud Account
- T1485 Data Destruction

## Sources

- [npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk](https://thehackernews.com/2026/07/npm-12-disables-install-scripts-by.html)
- [GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks](https://thehackernews.com/2026/06/github-to-disable-npm-install-scripts.html)
- [Preparing for npm v12: install scripts and non-registry sources become opt-in](https://github.com/orgs/community/discussions/198547)
- [npm-approve-scripts CLI reference](https://docs.npmjs.com/cli/v11/commands/npm-approve-scripts/)
- [Shai-Hulud npm supply chain attack: What you need to know](https://www.reversinglabs.com/blog/shai-hulud-worm-npm)
- ["Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack](https://unit42.paloaltonetworks.com/npm-supply-chain-attack/)
- [Sha1-Hulud 2.0 Supply Chain Attack: 25K+ Repos Exposed](https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack)
- [Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack](https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/)
- [Shai-Hulud V2 Poses Risk to NPM Supply Chain](https://www.zscaler.com/blogs/security-research/shai-hulud-v2-poses-risk-npm-supply-chain)
- [500+ npm Packages Compromised in Ongoing Supply Chain Attack 'Shai-Hulud'](https://www.truesec.com/hub/blog/500-npm-packages-compromised-in-ongoing-supply-chain-attack-shai-hulud)
- [What We Know About the NPM Supply Chain Attack](https://www.trendmicro.com/en_us/research/25/i/npm-supply-chain-attack.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1163