npm v12 shipped on 2026-07-08 with a real security-motivated change: preinstall, install, and postinstall scripts are now disabled by default. The stated reason is legitimate — supply-chain attacks (Shai-Hulud, the Nx attack, event-stream) have repeatedly used install scripts to run arbitrary code the moment someone runs npm install.
The part that's easy to miss: npm ci doesn't fail when a script is blocked. It just skips it, silently, and exits 0.
If your project depends on a package that needs its install script to actually work — sharp (downloads a prebuilt binary), bcrypt or better-sqlite3 or canvas (compile a native addon via node-gyp), esbuild or node-sass (download a platform binary), husky (installs git hooks) — your CI can stay green while the thing it built is quietly broken. You find out later, sometimes in production, sometimes as a confusing runtime error that has nothing obviously to do with npm.
What I looked for and didn't find
There are several good written guides to the migration already (installsafe.dev, npmv12guide.com, a Semgrep write-up). What none of them do is look at your actual package.json and tell you which of your dependencies are the ones to check. So I built the small missing piece: a free, static, client-side page — paste your package.json, get a list of your dependencies that are known to rely on an install script, with the specific reason each one is flagged.
Nothing is uploaded. It's a static page with a <script> tag — check the source if you don't believe the privacy claim, it's not minified.
What it can't tell you
It only knows about a curated list of commonly-affected packages — not your transitive dependencies, and not packages nobody's reported issues with yet. Absence from the list is not a guarantee. Think of it as a fast first pass before you actually test on a real npm v12 environment, not a replacement for that test.
Link: https://timo6pi-glitch.github.io/npm-v12-checker/ (source: https://github.com/timo6pi-glitch/npm-v12-checker)
If there's a package that should be on the list and isn't, I'd like to know — that's the main way this gets more useful over time.
Top comments (0)