GitHub Locks Down npm: What the New Install Defaults Mean for Your Supply Chain

In July 2026, GitHub is going to change how npm install works for the first time in npm’s history - and it’s going to break some builds on purpose. Starting with npm v12 , the package manager will stop automatically running install scripts, pulling Git dependencies, or fetching dependencies from remote URLs unless you explicitly approve each one. Behavior that’s been on-by-default for over a decade is becoming opt-in.