Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

GitHub npm v12 hardens install-time dependency execution and source resolution

Security Tool/Service
First reported
Last updated
Happening score
H score 11
2 unique sources, 2 articles

Summary

Hide ▲

GitHub is tightening npm v12 next month by blocking automatic dependency install scripts and non-registry sources, reducing supply-chain attack paths triggered by npm install. By default, preinstall, install, postinstall, node-gyp, and some prepare scripts will need explicit approval, and Git-based and remote URL dependencies will no longer resolve automatically. The update raises the bar for package-based code execution and forces teams to review workflows that depend on automatic installation behavior.

Related Happenings

GitHub npm version 12 hardens installs and token management

Security Tool/Service
H score11 First: 09.07.2026 19:49 Last: 09.07.2026 19:49 Sources 1

About this happening: GitHub released npm version 12, making install-time scripts opt-in by default and tightening package publishing controls to reduce supply-chain risk. The update al...

Open Happening

GitHub npm GAT publish-token mitigation guidance

Advisory/Mitigation
H score25 First: 09.07.2026 19:49 Last: 09.07.2026 19:49 Sources 1

About this happening: GitHub is steering npm users away from long-lived publish tokens as npm GATs that bypass 2FA lose direct publishing and sensitive-management abilities. The recomme...

Open Happening

GitHub actions/checkout blocks fork pull request checkouts by default in privileged workflows

Security Tool/Service
H score11 First: 23.06.2026 17:22 Last: 23.06.2026 17:22 Sources 1

About this happening: GitHub's actions/checkout now refuses common pwn request patterns by default, cutting the risk of attacker-controlled code execution in privileged GitHub Actions workf...

Open Happening

Npm v12 default-blocks install scripts, Git dependencies, and remote URLs

Security Tool/Service
H score11 First: 12.06.2026 16:00 Last: 12.06.2026 16:00 Sources 1

About this happening: GitHub announced npm v12 with default-blocking install scripts, Git dependencies, and remote URLs, shifting package installation to explicit opt-in and reducing supp...

Open Happening

Miasma supply-chain malware activity

Malware Activity
H score34 First: 10.06.2026 23:27 Last: 10.06.2026 23:27 Sources 1

About this happening: The Miasma malware activity is enabling supply-chain compromise by stealing build environment and cloud credentials, then using them to poison legitimate packages...

Open Happening

Timeline

  1. 10.06.2026 22:41 3 articles · 1mo ago

    GitHub hardens npm v12 install-time dependency execution

    Initial Disclosure

    GitHub announced that npm v12, expected next month, will require explicit approval before npm install runs dependency preinstall, install, postinstall, node-gyp, and some prepare scripts, and before it fetches Git-based or remote URL dependencies. GitHub says npm 11.16.0 or newer will warn about actions that break under version 12 so developers can review workflows before upgrading.

    Show sources
    Open in new tab