Version 12.0 of the package manager NPM has been released, included with Node.js and used for distributing modules in JavaScript. This new version is notable for disabling script execution by default during package installation. This change is expected to complicate attacks through dependency compromise and slow down the spread of worms activated from installation scripts.
To disable the automatic execution of scripts specified in package.json via preinstall, install, or postinstall parameters, the allowScripts setting is now set to 'off' by default. Executing such scripts, as well as running C/C++ code compilation with the node-gyp utility if a binding.gyp file is present in the package, now only occurs upon explicit user instruction. Additionally, the parameters '--allow-git' and '--allow-remote' are now set to 'none' by default, disabling automatic downloading of dependencies from Git repositories and direct links to tar archive sites.
To initiate the execution of installation scripts, the command 'npm approve-scripts' should be used, with the names of trusted packages provided as arguments or the '--all' option to grant permission to all packages. For questionable packages, it is recommended to run the command 'npm approve-scripts --allow-scripts-pending', which will list the scripts pending execution. After reviewing these scripts, they can be approved with the command 'npm approve-scripts' and added to the whitelist in package.json.
Additionally, the use of GAT (Granular Access Tokens) in the NPM repository for actions without two-factor authentication (2FA) has been banned. Starting in August, such tokens will not allow operations like creating or deleting tokens, changing profiles, passwords or email, setting up two-factor authentication, generating recovery codes, changing access rights, and managing associates without additional manual confirmation.
I januari 2027 avser man att förbjuda direktpublicering av paket med anvÀndning av token som omgÄr 2FA. Paketen kommer dock att kunna publiceras i staging-avsnittet, dÀr de kommer att ligga tills den ansvariga personen manuellt bekrÀftar releasen. Efter manuell bekrÀftelse kommer de publicerade paketen att bli tillgÀngliga för installation av anvÀndare.
För automatiserad publicering föreslÄs mekanismen 'Trusted Publishers', baserad pÄ standarden OpenID Connect (OIDC) och autentiseringstoken med begrÀnsad giltighetstid, som utbyts mellan externa tjÀnster och paketkatalogen för att bekrÀfta operationen av paketpubliceringen istÀllet för att anvÀnda traditionella lösenord eller permanenta API-Ätkomsttoken.
KĂ€lla: opennet.ru
