npm v12 silently skips install scripts - here's how to check if that breaks you

npm v12 shipped on 2026-07-08 with a real security-motivated change: preinstall, install, and postinstall scripts are now disabled by default. The stated reason is legitimate - supply-chain attacks (Shai-Hulud, the Nx attack, event-stream) have repeatedly used install scripts to run arbitrary code the moment someone runs npm install.

The part that's easy to miss: npm ci doesn't fail when a script is blocked. It just skips it, silently, and exits 0.

If your project depends on a package that needs its install script to actually work -

• sharp (downloads a prebuilt binary)

• bcrypt, better-sqlite3, or canvas (compile a native addon via node-gyp)

• esbuild or node-sass (download a platform binary)

• husky (installs git hooks)

• your CI can stay green while the thing it built is quietly broken. You find out later, sometimes in production, sometimes as a confusing runtime error that has nothing obviously to do with npm.

What I looked for and didn't find

There are several good written guides to the migration already (installsafe.dev, npmv12guide.com, a Semgrep write-up). What none of them do is look at your actual package.json and tell you which of your dependencies are the ones to check.

So I built the small missing piece: a free, static, client-side page - paste your package.json, get a list of your dependencies that are known to rely on an install script, with the specific reason each one is flagged.

Nothing is uploaded. It's a static page with a <script> tag - check the source if you don't believe the privacy claim, it's not minified.

What it can't tell you

It only knows about a curated list of commonly-affected packages - not your transitive dependencies, and not packages nobody's reported issues with yet. Absence from the list is not a guarantee.

Think of it as a fast first pass before you actually test on a real npm v12 environment, not a replacement for that test.

Link

https://timo6pi-glitch.github.io/npm-v12-checker/ (source: https://github.com/timo6pi-glitch/npm-v12-checker)

If there's a package that should be on the list and isn't, I'd like to know - that's the main way this gets more useful over time.