npm 12 turns on install-time security defaults and phases out 2FA-bypass tokens

Why it matters

npm installations have historically been able to execute dependency lifecycle scripts and resolve other dependency sources as part of a routine build. That behavior is useful, but it also creates a software-supply-chain execution surface: a compromised package, maintainer account, or dependency reference can run code during development or CI. npm 12 changes that trust model from automatic execution to explicit approval. The same release also begins removing sensitive capabilities from long-lived tokens that bypass two-factor authentication, raising the baseline for package-publishing security.

What happened

GitHub announced that npm 12 is now generally available with install-time security defaults enabled. Dependency preinstall, install, and postinstall scripts, implicit node-gyp builds, Git dependencies, and remote URL dependencies no longer run or resolve automatically unless a project explicitly permits them. GitHub also said npm granular access tokens configured to bypass two-factor authentication will lose sensitive account, package, and organization-management capabilities as the rollout progresses. Direct publishing with those tokens is expected to be removed later, with staged publishing or trusted publishing through OIDC recommended instead.

Technical details

The new controls affect three areas of the npm workflow. First, allowScripts defaults to off, so teams must review pending scripts and create an approval allowlist rather than inheriting execution from every dependency. Second, --allow-git and --allow-remote default to restrictive settings, reducing implicit retrieval from Git repositories and remote tarballs. Third, npm is tightening granular access tokens that bypass 2FA: sensitive account changes will require interactive authentication, and future publishing changes will reduce the usefulness of long-lived credentials in automation. These changes are preventive controls, not evidence that a particular package or organization was compromised.

Defender actions

Inventory CI and developer workflows that rely on install-time scripts, native builds, Git dependencies, or remote tarballs. Test upgrades against npm 12 in a controlled branch, review the pending-script list, and commit only the approvals required by trusted packages. Treat unexpected new install scripts as a supply-chain review trigger. For publishing automation, identify granular access tokens that bypass 2FA, replace them where possible with trusted publishing using OIDC, and use staged publishing with human approval during migration. Review package and organization audit logs for unexpected token, maintainer, or publishing changes, and document exceptions so future dependency updates do not silently restore broad execution privileges.