npm v12 shipped on 2026-07-08 with a real security-motivated change: preinstall, install, and postinstall scripts are now disabled by default. The stated reason is legitimate — supply-chain attacks (Shai-Hulud, the Nx attack, event-stream) have repeatedly used install scripts to run arbitrary code the moment someone runs npm install.
The part that's easy to miss: npm ci doesn't fail when a script is blocked. It just skips it, silently, and exits 0.
If your project depends on a package that needs its install script to actually work — sharp (downloads a prebuilt binary), bcrypt or better-sqlite3 or canvas (compile a native addon via node-gyp), esbuild or node-sass (download a platform binary), husky (installs git hooks) — your CI can stay green while the thing it built is quietly broken. You find out later, sometimes in production, sometimes as a confusing runtime error that has nothing obviously to do with npm.
What I looked for and didn't find
There are several good written guides to the migration already (installsafe.dev, npmv12guide.com, a Semgrep write-up). What none of them do is look at your actual package.json and tell you which of your dependencies are the ones to check. So I built the small missing piece: a free, static, client-side page — paste your package.json, get a list of your dependencies that are known to rely on an install script, with the specific reason each one is flagged.
