The release of package manager NPM 12.0 has been published, which is included with Node.js and used for distributing JavaScript modules. The new version notably defaults to disabling the execution of scripts during package installation. This change is expected to complicate the execution of attacks through dependency compromise and slow down the spread of worms activated from installation scripts.
To disable the auto-execution of scripts specified in package.json via the preinstall, install, or postinstall options, the allowScripts setting is now set to 'off' by default. Execution of such scripts, as well as the compilation of C/C++ code by the node-gyp utility when a binding.gyp file is present in the package, will now only occur with explicit user instruction. In addition, the parameters '--allow-git' and '--allow-remote' are now set to 'none' by default, which disables the automatic loading of dependencies from Git repositories and direct links to tar archive sites.
To manage the execution of installation scripts, the command 'npm approve-scripts' should be used, with the package names of trusted packages passed as arguments, or the option '--all' to grant permission to all packages. For suspicious packages, it is recommended to run the command 'npm approve-scripts --allow-scripts-pending', which will display a list of scripts pending execution. After reviewing these scripts, they can be approved with the command 'npm approve-scripts' and added to the whitelist in package.json.
Additionally, the use of GAT (Granular Access Tokens) in the NPM repository has been announced to be banned, specifically those configured to perform actions without two-factor authentication (2FA). Starting in August, such tokens will not allow operations like creating or deleting tokens, changing profiles, passwords, or email, setting up two-factor authentication, generating recovery codes, modifying access rights, and managing collaborators without additional manual confirmation.
In January 2027, direct publication of packages using tokens that bypass 2FA is set to be prohibited. However, packages will still be able to be published in the staging section, where they will remain until manually confirmed for release by the accompanying person. After manual confirmation, the published packages will be available for installation by users.
For automated publication, it is proposed to use the 'Trusted Publishers' mechanism, which is based on the OpenID Connect (OIDC) standard and authentication tokens with limited validity that are exchanged between external services and the package catalog to confirm the publication operation instead of using traditional passwords or permanent access tokens to the API.
Source: opennet.ru
