GitHub changes npm defaults to disable automatic script execution on install, closing major security vector
By
Tim Anderson
The bagel they save for the regulars. Don't skim, savour.
Summary
GitHub is changing npm's default behavior so that the install command no longer automatically runs lifecycle scripts, closing a major security vulnerability that has been exploited by malicious packages like the Shai-Hulud worm. This feature, which allowed arbitrary code execution from any compromised dependency in a developer's dependency tree, has been described as the largest code-execution surface in the npm ecosystem. The change aims to significantly improve security for developers and CI environments.
Key quotes
· 2 pulledInstall-time lifecycle scripts are the single largest code-execution surface in the npm ecosystem.
Every npm install runs scripts from every transitive dependency, so a single compromised package anywhere in your tree can execute arbitrary code on a developer machine or CI.
You might also wanna read
npm v12 to disable dependency scripts by default for improved security
npm v12, estimated for July 2026, will introduce security-related breaking changes to npm install. The key change is that allowScripts will
github.blog·3d ago
npm to Implement Staged Publishing as Security Response to Supply Chain Attacks
npm is implementing staged publishing as a security response to supply chain attacks, particularly the Shai-Hulud campaign that exposed vuln
socket.dev·5mo ago
GitLab Identifies Large-Scale npm Supply Chain Attack with Destructive Malware
GitLab's security researchers have uncovered a large-scale supply chain attack in the npm ecosystem involving a destructive malware variant
about.gitlab.com·6mo ago
Shai-Hulud: Largest npm Supply-Chain Compromise Affecting CrowdStrike and Hundreds of Packages
The Shai-Hulud malware campaign represents the largest and most dangerous npm supply-chain compromise in history, affecting hundreds of pack
koi.security·8mo ago
Config File Auto-Execution Creates Supply Chain Security Blindspot Across IDEs and Package Managers
This article exposes a critical supply chain security blindspot where ordinary-looking configuration files in code repositories can automati
safedep.io·4d ago
GitHub Issue Prompt Injection Leads to 4,000 Developer Machines Compromised via Malicious npm Package
A sophisticated supply chain attack compromised approximately 4,000 developer machines through a GitHub issue title prompt injection. The at
grith.ai·3mo ago