{"id":182580,"date":"2026-07-09T22:53:44","date_gmt":"2026-07-09T20:53:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-npm-12-0-po-umolchaniyu-otklyuchyon-zapusk-skriptov-pri-ustanovke-paketov"},"modified":"2026-07-09T22:53:44","modified_gmt":"2026-07-09T20:53:44","slug":"v-npm-12-0-po-umolchaniyu-otklyuchyon-zapusk-skriptov-pri-ustanovke-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-npm-12-0-po-umolchaniyu-otklyuchyon-zapusk-skriptov-pri-ustanovke-paketov","title":{"rendered":"In NPM 12.0, script execution during package installation is disabled by default","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The release of package manager NPM 12.0 has been published, which is included with Node.js and used for distributing JavaScript modules. The new version notably defaults to disabling the execution of scripts during package installation. This change is expected to complicate the execution of attacks through dependency compromise and slow down the spread of worms activated from installation scripts. <\/p>\n
To prevent the automatic execution of scripts specified in package.json via preinstall, install, or postinstall parameters, the allowScripts setting is by default set to 'off'. The execution of such scripts, as well as the compilation of C\/C++ code using the node-gyp utility when a binding.gyp file is present in the package, will now occur only upon receiving explicit instructions from the user. Additionally, the parameters '--allow-git' and '--allow-remote' are now by default set to 'none', which disables automatic loading of dependencies from Git repositories and direct links to sites with tar archives. <\/p>\n
To facilitate the execution of installation scripts, the command 'npm approve-scripts' should be used, taking as arguments the names of trusted packages or the '--all' option to grant permission to all packages. For suspicious packages, it is recommended to run the command 'npm approve-scripts --allow-scripts-pending', which will output a list of scripts pending execution. After reviewing these scripts, they can be approved with the command 'npm approve-scripts' and added to the whitelist in package.json. <\/p>\n
Additionally, the use of GAT (Granular Access Tokens) in the NPM repository has been announced to be banned, specifically those configured to perform actions without two-factor authentication (2FA). Starting in August, such tokens will not allow operations like creating or deleting tokens, changing profiles, passwords, or email, setting up two-factor authentication, generating recovery codes, modifying access rights, and managing collaborators without additional manual confirmation. <\/p>\n
In January 2027, direct publication of packages using tokens that bypass 2FA is set to be prohibited. However, packages will still be able to be published in the staging section, where they will remain until manually confirmed for release by the accompanying person. After manual confirmation, the published packages will be available for installation by users. <\/p>\n
For automatic publishing, it is recommended to use the 'Trusted Publishers' mechanism, based on the use of the OpenID Connect (OIDC) standard and time-limited authentication tokens, which are exchanged between external services and the package registry to confirm the package publication operation instead of using traditional passwords or permanent API access tokens. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"