npm v12 silently skips install scripts — here's how to check if that breaks you

tim — Thu, 20 Aug 2026 19:05:39 +0000

npm v12 shipped on 2026-07-08 with a real security-motivated change: preinstall, install, and postinstall scripts are now disabled by default. The stated reason is legitimate — supply-chain attacks (Shai-Hulud, the Nx attack, event-stream) have repeatedly used install scripts to run arbitrary code the moment someone runs npm install.

The part that's easy to miss: npm ci doesn't fail when a script is blocked. It just skips it, silently, and exits 0.

If your project depends on a package that needs its install script to actually work — sharp (downloads a prebuilt binary), bcrypt or better-sqlite3 or canvas (compile a native addon via node-gyp), esbuild or node-sass (download a platform binary), husky (installs git hooks) — your CI can stay green while the thing it built is quietly broken. You find out later, sometimes in production, sometimes as a confusing runtime error that has nothing obviously to do with npm.

What I looked for and didn't find

There are several good written guides to the migration already (installsafe.dev, npmv12guide.com, a Semgrep write-up). What none of them do is look at your actual package.json and tell you which of your dependencies are the ones to check. So I built the small missing piece: a free, static, client-side page — paste your package.json, get a list of your dependencies that are known to rely on an install script, with the specific reason each one is flagged.

Nothing is uploaded. It's a static page with a <script> tag — check the source if you don't believe the privacy claim, it's not minified.

What it can't tell you

It only knows about a curated list of commonly-affected packages — not your transitive dependencies, and not packages nobody's reported issues with yet. Absence from the list is not a guarantee. Think of it as a fast first pass before you actually test on a real npm v12 environment, not a replacement for that test.

Link: https://timo6pi-glitch.github.io/npm-v12-checker/ (source: https://github.com/timo6pi-glitch/npm-v12-checker)

If there's a package that should be on the list and isn't, I'd like to know — that's the main way this gets more useful over time.

DEV Community: tim

npm v12 silently skips install scripts — here's how to check if that breaks you

What I looked for and didn't find

What it can't tell you