GitHub Releases npm v12, Disables Install Scripts by Default and Deprecates Granular Access Tokens

GitHub announced the release of npm version 12, which disables install scripts by default and deprecates granular access tokens designed to bypass two‑factor authentication. The new default setting, allowScripts, is off, meaning that preinstall, postinstall, and other lifecycle scripts no longer run automatically. Developers must now explicitly opt‑in to allowScripts=true for trusted packages.

Additionally, GitHub has removed granular access tokens, forcing users to rely on fine‑grained tokens that respect 2FA. The change aims to reduce the attack surface of npm packages. However, it may break existing workflows that depend on preinstall scripts. Users should audit their dependencies and update npm to v12. Security teams should verify that critical packages still function after the change.