{}Best AI Code Security

NOTE · 24 SEP 2026

npm v12 install script defaults: what changes for AI coding agents

ANSWER FIRST

npm v12 will not run dependency install scripts unless they are approved, and will not resolve git or remote URL dependencies without an explicit flag. For teams whose coding agents run npm install, that closes one path for a malicious package to run code at install, but it does not check what a package does once it is imported.

Editorial assessment · Compiled from vendor product, docs, pricing and marketplace pages · Rated October 2026

By Best AI Code Security reviewers · Published 24 September 2026

What did GitHub announce?

On 9 June 2026 GitHub published a notice of breaking changes for npm v12, with the release estimated for July 2026. Three defaults change:

  • Install scripts. npm install no longer runs a dependency's preinstall, install or postinstall scripts. Scripts must be approved with npm approve-scripts. Native builds such as node-gyp are blocked by default as well.
  • Git dependencies. Direct or transitive git dependencies do not resolve unless allowed with --allow-git, which defaults to none. GitHub notes that this closes a path where an .npmrc file could override the git executable.
  • Remote dependencies. Dependencies from remote URLs, such as HTTPS tarballs, need --allow-remote, which also defaults to none. The flag is available from npm 11.15.0.

GitHub's advice is to move to npm 11.16.0 or later first, read the warnings it prints during normal installs, and approve scripts for trusted packages before upgrading to v12.

Source: GitHub Changelog: upcoming breaking changes for npm v12 · Reviewed Sep 2026

Why does this matter more when an agent runs npm install?

An install script runs code on the machine at install time, before anyone has reviewed the package. When a developer types npm install, the developer chose the package. When a coding agent runs it, the package name came from a model, and the command runs in a session that can usually read the repository and whatever credentials the developer has locally. Under the v12 defaults, a newly added package's install scripts wait for approval instead of running.

The change also touches agents that pull code from a git URL or a tarball, because both now need a flag. If an agent proposes adding --allow-git, --allow-remote or a script approval, treat that as a dependency change that needs human review, the same as a new entry in package.json.

Agents also run installs in places a person rarely watches: a background task, a sandbox or a CI job the agent started. The new defaults apply there only if that environment runs npm v12 or later, which is why the first step in the checklist below covers agent sandboxes and CI as well as laptops.

What does npm v12 not cover?

The new defaults act on install-time behavior in npm. They do not inspect code that runs when a package is imported, they do not apply to other registries such as PyPI, Go modules or Maven, and they leave the approval decision to whoever runs the command, person or agent. That is the gap install-time package checks are built for.

Which tools check packages at install time?

  • Aikido Security: Aikido Safe Chain blocks malware at package install.

    Source: aikido.dev · Reviewed Sep 2026

  • Endor Labs: a package firewall and malicious package detection. Threat Center, announced on 9 September 2026, tracks malicious packages in ecosystems such as npm and PyPI and maps them to a customer's projects, and Package Firewall now also checks VS Code extension updates.

    Source: endorlabs.com: Threat Center · Reviewed Sep 2026

  • OX Security: VibeSec Dependency Vetting, announced on 9 September 2026, inspects each package install an AI agent attempts, blocks known-malicious packages and can apply cool-down periods to newly published versions.

    Source: ox.security: Dependency Vetting · Reviewed Sep 2026

  • Semgrep: Guardian blocks malicious dependencies before install inside Claude Code, Cursor and Windsurf, and since 24 September 2026 Semgrep Supply Chain has malware detection with a Malware Firewall in private beta.

    Source: semgrep.dev: malware detection · Reviewed Sep 2026

  • Legit Security: VibeGuard 2.0 monitors and enforces agent commands against built-in or custom policy on the developer endpoint, and Legit's supply chain module applies policy across CI/CD pipelines and other SDLC systems.

    Source: legitsecurity.com: VibeGuard 2.0 · Reviewed Sep 2026

What should a team do before npm v12 lands?

  1. Move developer machines, agent sandboxes and CI to npm 11.16.0 or later, and read the warnings on normal installs.
  2. Keep the list of approved install scripts in the repository and review changes to it like code.
  3. Add a rule to each assistant's instruction file that script approvals and --allow-git or --allow-remote flags need human review. Our guide lists the file names for Copilot and Cursor.
  4. For Claude Code, a PreToolUse hook can check a command before it runs and block it, including an install that adds those flags.
  5. Keep an install-time package check for other ecosystems and for packages that are malicious at import rather than at install.
  6. Keep SCA on every pull request. A lockfile change from an agent needs the same review as one from a person.

Source: Claude Code hooks documentation · Reviewed Sep 2026

Secrets and supply chain controls carry 15% of our score; the ranking shows how each vendor scores on that criterion, and the glossary defines install scripts and dependency cooldowns.

Sources

  1. GitHub Changelog: upcoming breaking changes for npm v12 github.blog
  2. Aikido Security: homepage aikido.dev
  3. Endor Labs: homepage endorlabs.com
  4. Endor Labs: Threat Center and Package Firewall endorlabs.com
  5. OX Security: Dependency Vetting ox.security
  6. Semgrep: Guardian semgrep.dev
  7. Semgrep: malware detection and response semgrep.dev
  8. Legit Security: VibeGuard 2.0 press release legitsecurity.com
  9. Legit Security: software supply chain security legitsecurity.com
  10. Legit Security blog: GitHub locks down npm legitsecurity.com
  11. Claude Code hooks documentation code.claude.com

Related on this site