{"id":4882,"date":"2026-08-20T19:23:22","date_gmt":"2026-08-20T19:23:22","guid":{"rendered":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/08\/20\/npm-v12-shuts-down-a-popular-malware-trick-but-the-threat-isnt-going-away\/"},"modified":"2026-08-20T19:23:22","modified_gmt":"2026-08-20T19:23:22","slug":"npm-v12-shuts-down-a-popular-malware-trick-but-the-threat-isnt-going-away","status":"publish","type":"post","link":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/08\/20\/npm-v12-shuts-down-a-popular-malware-trick-but-the-threat-isnt-going-away\/","title":{"rendered":"npm v12 Shuts Down a Popular Malware Trick \u2014 But the Threat Isn\u2019t Going Away"},"content":{"rendered":"
\"\"<\/div>\n

\"\"<\/p>\n

For years, one of the easiest ways to sneak malware onto a developer\u2019s machine has been to hide in plain sight. Install a package from npm, and any lifecycle script bundled with it runs automatically \u2014 no review, no approval, no second look. Attackers have known this for a long time, and they\u2019ve used it well. A poisoned package with a malicious \u201cpostinstall\u201d script doesn\u2019t require a developer to do anything other than run <\/span>npm install<\/span>.<\/span><\/p>\n

npm v12 changes that. Lifecycle scripts no longer execute automatically during installation. Developers now have to approve them first. It\u2019s a meaningful shift, and one that security teams have wanted for a while. But according to a new analysis from Checkmarx, closing this door doesn\u2019t close the case. It may just move attackers toward a different target: runtime.<\/span><\/p>\n

\u201cIt\u2019s a bit like locking a door in a glass house: robbers will just start breaking windows,\u201d said Darren Meyer, security research advocate at Checkmarx. \u201cMalware authors often use lifecycle scripts because they\u2019re nearly guaranteed to execute. Infecting the modules in a way that works at runtime requires a little more effort. But with npm\u2019s changes now \u2018locking the door,\u2019 the authors will almost certainly find the additional effort worth it.\u201d<\/span><\/p>\n

That\u2019s the core tension behind npm v12\u2019s new protection. It raises the cost of the easiest attack path, and that\u2019s genuinely useful \u2014 attacker cost is one of the few levers defenders actually control. But it doesn\u2019t remove the incentive to compromise packages in the first place. It just pushes attackers to hide malicious behavior inside code that runs later, when a package is imported or used, rather than the moment it\u2019s installed.<\/span><\/p>\n

There\u2019s also a second problem, and it\u2019s a human one. npm v12 puts developers in the position of approving or denying lifecycle scripts before they run. In theory, that\u2019s a checkpoint. In practice, most lifecycle scripts are harmless, and developers know it. Meyer expects that familiarity to work against the protection over time.<\/span><\/p>\n

\u201cDevelopers are under immense pressure to ship quickly,\u201d Meyer said. \u201cSince most package lifecycle scripts are safe, developers will get very used to approving execution of them without doing any kind of inspection first. Even if they do give a cursory inspection of a script before approving it, they aren\u2019t likely to have the time or desire to analyze it well enough to notice cleverly hidden malicious content. This will likely lead developers to approve prompts without reading or figure out how to auto-approve everything they install.\u201d<\/span><\/p>\n

That\u2019s approval fatigue, and it\u2019s a familiar story in security. Any control that depends on a person clicking \u201cyes\u201d repeatedly, correctly, under deadline pressure, tends to degrade. The fix isn\u2019t asking developers to be more careful. It\u2019s building policy around the assumption that they won\u2019t always be.<\/span><\/p>\n

Meyer\u2019s advice for security teams is to treat allowlisting as a shared decision between security and engineering, not a blanket restriction handed down from above. \u201cEvery team\u2019s risk tolerance will be different,\u201d he said. \u201cBut ideally, teams should find ways to work with developers to set appropriate allowScripts policy that results in denying lifecycle scripts that aren\u2019t essential, and approving those that have been assessed to be acceptably safe. Combining this with configuration management that makes \u2018strict-allow-scripts\u2019 the default npm behavior can help reduce alert fatigue while still providing a safety net.\u201d<\/span><\/p>\n

That\u2019s a more practical answer than telling every team to run <\/span>\u2013ignore-scripts<\/span> and call it done. Some packages genuinely need their install scripts to function. The goal isn\u2019t zero scripts \u2014 it\u2019s fewer unreviewed ones, enforced by default rather than left to individual judgment calls in the middle of a sprint. Meyer\u2019s point about balance matters here too: developers need to move fast and pull in open-source packages without friction on every install, and security teams need some assurance that what\u2019s running hasn\u2019t been rubber-stamped without a look.<\/span><\/p>\n

None of this makes npm v12 a wasted effort. It raises the bar for anyone trying to compromise a developer\u2019s workstation, a CI pipeline, or a production environment through a malicious package. That\u2019s real progress, and it deserves credit as such.<\/span><\/p>\n

\u201cI applaud npm taking this \u2018lock the door\u2019 step,\u201d Meyer said, \u201cbut organizations need to understand that locking this door doesn\u2019t stop malware authors from getting into the house: it just makes them break the window.\u201d<\/span><\/p>\n

That\u2019s the framing worth carrying into any conversation about software supply chain security this year. Controls like this one are worth implementing, but they\u2019re not a finish line. Attackers adapt to whatever gets harder, and the practical response for most teams is the same one that\u2019s worked for other classes of security controls: pair the technical fix with a policy that assumes people will get tired of clicking \u201capprove\u201d and keep watching for the next window.<\/span><\/p>\n

Read More<\/a><\/p>\n

\u200b<\/p>","protected":false},"excerpt":{"rendered":"

For years, one of the easiest ways to sneak malware onto a developer\u2019s machine has been to hide in plain […]<\/p>\n","protected":false},"author":1,"featured_media":4883,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[5],"tags":[],"class_list":["post-4882","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops"],"_links":{"self":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/4882","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/comments?post=4882"}],"version-history":[{"count":0,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/4882\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media\/4883"}],"wp:attachment":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media?parent=4882"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/categories?post=4882"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/tags?post=4882"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}