---
id: 2422
title: "npm v12 delivers one of the biggest security improvements in years"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/npm-v12-block-postinstall"
published_at: "2026-06-11 00:00"
tags: ["supply-chain", "devsecops", "open-source", "malware", "npm", "supply-chain-security", "shai-hulud", "package-registry", "package-manager", "nodejs", "allowlist", "postinstall", "security-defaults", "node-gyp", "install-scripts", "postinstall-scripts"]
phying_url: "https://phying.com/item/2422"
lang: en
---

# npm v12 delivers one of the biggest security improvements in years

## Summary

npm v12 (July 2026) stops running dependency install scripts by default, requiring an allowlist—closing the postinstall vector exploited by Shai-Hulud and Nx, plus stricter git dependency rules.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2026-06-11 00:00
- **Original:** https://www.aikido.dev/blog/npm-v12-block-postinstall
- **Phying News:** https://phying.com/item/2422