npm 12 turns off install scripts, and starts killing 2FA-bypass tokens

npm 12 changes three defaults. Lifecycle scripts, preinstall, install, postinstall, and implicit node-gyp builds, no longer run unless explicitly allowed via npm approve-scripts --allow-scripts-pending. Git dependencies now need --allow-git, and remote URL dependencies need --allow-remote.

The identity half got less attention and is arguably more consequential. Granular access tokens that bypass two-factor authentication are being retired on a schedule: from early August 2026 they can no longer change account settings, package access, or organisation management, and from January 2027 they lose direct publish, which will require human 2FA approval instead.

Why it matters

An npm token is a non-human identity with publish rights over code that lands on thousands of machines, and until now a stolen one could silently push a release. Every recent npm supply-chain incident follows that shape: compromise a maintainer credential, publish a version with a malicious postinstall, wait. npm 12 attacks both halves, removing the automatic execution and removing the token that made silent publishing possible.

The action is on the automation, not the humans. Long-lived publish tokens in CI need to move to trusted publishing via OIDC, or to staged publishing with an approval step, and January 2027 is the deadline. That is the same transition away from static secrets toward short-lived workload credentials that machine identity tooling exists to manage, arriving as a hard cutoff rather than a recommendation. Before re-enabling any install script, ask why a package needs to execute code merely to be installed. For most dependencies the honest answer is that it does not.

Source: The Hacker News