Overview
npm (Node Package Manager) is the default package manager for the nodejs ecosystem, maintained by github since its 2020 acquisition. It hosts the world’s largest open-source JavaScript registry and is foundational infrastructure for web development.
Recent Developments
- 2026-08-04: shai-hulud-worm compromises keyv family then 1,280+ packages; remediation emphasizes
--ignore-scripts, overrides, credential rotation (2026-08-04-devops-shai-hulud-1280-packages) - 2026-06-09: GitHub announced npm v12 (estimated July 2026) with three breaking security defaults —
allowScriptsoff,--allow-git none,--allow-remote none(2026-06-09-npm-v12-supply-chain-security) - 2026-06-10: npm 11.16.0+ surfaces advisory warnings;
npm approve-scriptsworkflow enables allowlist migration before v12 (2026-06-10-npm-v12-exploitr-supply-chain-mitigation) - 2026-06-01/05: miasma-worm campaign exploited install-time lifecycle scripts across Red Hat and Microsoft packages
npm v12 Security Model
| Default | v11 and earlier | v12 (July 2026) |
|---|---|---|
| Install scripts | Run automatically | Blocked unless in allowScripts allowlist |
| Git dependencies | Resolved automatically | Require --allow-git |
| Remote URL deps | Resolved automatically | Require --allow-remote |
Key commands: npm approve-scripts --allow-scripts-pending, npm approve-scripts, npm deny-scripts. Allowlist stored in package.json and should be committed to source control.
npm is the only remaining major package manager that runs dependency install scripts by default. pnpm v10+, Yarn Berry, Bun, and Deno all block them.
Related
- nodejs
- javascript
- github
- github-security
- supply-chain-attacks
- miasma-worm
- shai-hulud-worm
- snyk
- socket
- devtools