npm 12 stops running dependency install scripts by default
npm v12 became the default on July 8. Dependency lifecycle scripts, Git dependencies and remote URL dependencies are now opt-in.
What to do
Check your CI before it surprises you. To opt specific packages back in, run npm approve-scripts --allow-scripts-pending and commit the resulting allowlist.
npm v12 became the default ("latest") on July 8. Three behaviors that used to run automatically are now opt-in:
- Dependency lifecycle scripts (preinstall, install, postinstall and implicit node-gyp builds) don't run unless you approve them.
- Git dependencies are blocked unless you allow them (--allow-git).
- Remote URL dependencies, such as https tarballs, are blocked unless you allow them (--allow-remote).
Publishing is changing too. Tokens that bypass 2FA already lost sensitive account operations in early August, and around January 2027 they lose the ability to publish at all. The replacements are trusted publishing (OIDC) or staged publishing, where a human approves each release with 2FA.