You will get the warnings but default npm in Node will still run the scripts.
npm 12 has the relevant breaking changes: https://github.blog/changelog/2026-06-09-upcoming-breaking-c...
Node 27 will likely ship with it:
https://github.com/nodejs/Release/issues/1161
https://github.com/npm/cli/issues/9997
In Zod 4.6.6 compromised by malware?npm
cli
JavaScript2018–2026
npm / cli
cli
the package manager for JavaScript
55Distinct people
59Mentions
0Explicit recommenders
10.3KGitHub stars
What to know before exploring
What it is
the package manager for JavaScript
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 12:45:45 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year59 dated mentions
Observed mentions: 2018-12-03 07:29:37 UTC to 2026-10-12 14:10:06 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 4 | 3 | 1 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 11 | 2 | 9 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 9 | 2 | 7 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 6 | 2 | 4 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 2 | 1 | 1 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 12 | 3 | 9 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 12 | 4 | 8 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
npm - a JavaScript package manager
Requirements
You should be running a currently supported version of Node.js to run npm. For a list of which versions of Node.js are currently supported, please see the Node.js releases page.
Installation
npm comes bundled with node, & most third-party distributions, by default. Officially supported downloads/distributions can be found at: nodejs.org/en/download
Direct Download
You can download & install npm directly from npmjs.com using our custom install.sh script:
curl -qL https://www.npmjs.com/install.sh | sh
Node Version Managers
If you're looking to manage multiple versions of Node.js &/or npm, consider using a node version manager
Usage
npm <command>
Links & Resources
Documentation - Official docs & how-tos for all things npm
Note: you can also search docs locally with npm help-search <query>
Bug Tracker - Search or submit bugs against the CLI
Community Feedback and Discussions - Contribute ideas & discussion around the npm registry, website & CLI
RFCs - Contribute ideas & specifications for the API/design of the npm CLI
Service Status - Monitor the current status & see incident reports for the website & registry
Project Status - See the health of all our maintained OSS projects in one view
Support - Experiencing problems with the npm website or registry? File a ticket
Acknowledgments
npm is configured to use the npm Public Registry at https://registry.npmjs.org by default; Usage of this registry is subject to Terms of Use available at https://npmjs.com/policies/terms
You can configure npm to use any other compatible registry you prefer. You can read more about configuring third-party registries
FAQ on Branding
Is it "npm" or "NPM" or "Npm"?
npm should never be capitalized unless it is being displayed in a location that is customarily all-capitals (ex. titles on man pages).
Is "npm" an acronym for "Node Package Manager"?
Contrary to popular belief, npm is not an acronym for "Node Package Manager." It is a recursive backronymic abbreviation for "npm is not an acronym" (if the project were named "ninaa," then it would be an acronym). The precursor to npm was actually a bash utility named "pm", which was the shortform name of "pkgmakeinst" - a bash function that installed various things on various platforms. If npm were ever considered an acronym, it would be as "node pm" or, potentially, "new pm".
Read the full README on GitHubWhat Hacker News says
59 sourcesNPM is experiencing elevated latency
2 points · Open discussionThere is some effort to make NPM more secure https://github.com/npm/cli/pull/9360.
In Malicious npm packages detected across Red Hat Cloud ServicesThey have taken action as of very recently. The latest version [1] of npm warns when there are install scripts and tells you they will be disabled by default in a future version, with a per-dependency opt in mechanism [2].
[1] https://github.com/npm/cli/releases/tag/v11.16.0
[2] https://github.com/npm/rfcs/pull/868
In NPM packages from Red Hat have been compromisedNPM introduces allowScripts opt-in install-script policy
3 points · Open discussionThere are positive things happening too. Recently, npm released min-release-age filtering the lets you only import packages that have a certain vintage, protecting you from all these supply chain attacks as they tend to be quickly detected.
https://github.com/npm/cli/releases/tag/v11.10.0
In Maybe you shouldn't install new software for a bitNPM seems to have introduced the flag `minimumReleaseAge` for this exact purpose. However even though are many recent references to it[0][1][2] I don't see it anywhere in the NPM documentation.
[0] https://news.ycombinator.com/item?id=47513932
[1] https://github.com/npm/cli/issues/8570
[2] https://socket.dev/blog/npm-introduces-minimumreleaseage-and...
In Maybe you shouldn't install new software for a bitThe NPM CLI has 65 production dependencies from the NPM registry
2 points · Open discussionThis specific GitHub issue is crashing
2 points · Open discussionPnpm did this first but I’m glad to see all the others follow suit
For anyone wondering, you need to be on npm >= 11.10.0 in order to use it. It just became available Feb 11 2026
https://github.com/npm/cli/releases/tag/v11.10.0
In Axios compromised on NPM – Malicious versions drop remote access trojanNPM only gained minimum package age in February of this year, and still doesn't support package exclusions for internal packages.
https://github.com/npm/cli/pull/8965
https://github.com/npm/cli/issues/8994
Its good that that they finally got there but....
I would be avoiding npm itself on principle in the JS ecosystem. Use a package manager that has a history of actually caring about these issues in a timely manner.
In Axios compromised on NPM – Malicious versions drop remote access trojan2025 was the year when we saw extreme impact of supply chain attack. npm did something last month to counter this by retiring old auth tokens in favor of a new authentication method they call trusted publishing, it uses OIDC to authenticate automated publishing via CI. but it seems like a rushed decision. poor coordination and incomplete docs. result: many package publishers are stuck and not able to release the updates to their package. It's not been two weeks and we already see almost 2k issues on github, the number will rise exponentially.
* Search results on github : https://github.com/search?q=npm+trusted+publishing&type=issu...
* the case in point: https://github.com/gitcommitshow/resilient-llm/issues/39
* Docs issue : https://github.com/npm/cli/issues/8884
* The bug : https://github.com/npm/cli/issues/8730
In From fear to pain: NPM trusted publishing and oidcI recently learned that this is (for all intents and purposes) a feature in npm as well, specifically the `--before` flag to `npm install`: https://docs.npmjs.com/cli/v11/commands/npm-install#before. That was harder than it should've been to figure out; it really needs better marketing.
Related to that is the proposal for `stabilityDays`, which seems way more practical: https://github.com/npm/cli/issues/8570#issuecomment-33004136.... So rather than merely saying "I only want package versions more than N days old", you'd be adding the requirement that "...and also they should have gone at least N days without a subsequent patch release". e.g. if mylib@6.0.0 is released, only to be quickly followed by 6.0.1 and 6.0.2, you ideally wouldn't want to risk ever installing the probably-broken 6.0.0 or 6.0.1 based on luck of the draw; the better b
Read the rest
ehavior would be to stick with the last 5.x release until 6.0.2 has aged past the threshold.
> Is that possible?
This comes up every time npm install is discussed. Yes, npm install will "ignore" your lockfile and install the latest dependancies it can that satisfy the constraints of your package.json. Yes, you should use npm clean-install. One shortcoming is the implementation insists on deleteing the entire node_modules folder, so package installs can actually take quite a bit of time, even when all the packages are being served from the npm disk cache: https://github.com/npm/cli/issues/564
In Pnpm has a new setting to stave off supply chain attacksAs others have noted, npm install can/will change your lockfile as it installs, and one caveat for the clean-install command they provide is that it is SLOW, since it deletes the entire node_modules directory. Lots of people have complained but they have done nothing: https://github.com/npm/cli/issues/564
The npm team eventually seemed to settle on requiring someone to bring an RFC for this improvment, and the RFC someone did create I think has sat neglected in a corner ever since.
In NPM debug and chalk packages compromisedShowing the 15 most recent of 59 sources. Enable JavaScript to search and browse every indexed mention.