npm v12 silently skips install scripts — here's how to check if that breaks you

On July 8, 2026, npm version 12 was released with a security-focused update that disables preinstall, install, and postinstall scripts by default. This decision aims to mitigate supply-chain attacks, such as Shai-Hulud, the Nx attack, and event-stream, which have exploited install scripts to execute unauthorized code upon running npm install.

However, a potential oversight lies in the behavior of npm ci. Unlike other npm commands, npm ci does not fail when an install script is blocked; instead, it merely skips it silently and exits with a 0 status code. As a result, projects relying on packages with functional install scripts, such as sharp, bcrypt, better-sqlite3, canvas, esbuild, or node-sass, might experience unnoticed issues, with failures only surfacing in a production environment or as perplexing runtime errors unrelated to npm.

While several guides exist to assist developers in navigating this migration, few provide a tool to examine a project's specific package.json file and identify dependencies that are likely to be affected. To address this gap, I have developed a free, static, client-side web page that allows users to input their package.json file and receive a list of dependencies known to rely on install scripts, along with the specific reason each one is flagged.

The tool is designed to offer a preliminary check before developers proceed to test their projects in an actual npm v12 environment. It's important to note that the tool relies on a curated list of commonly-affected packages and does not account for transitive dependencies or packages that have not yet been reported as problematic.

This information is presented statically without any data upload, ensuring user privacy. The page can be accessed at https://timo6pi-glitch.github.io/npm-v12-checker/. If there are packages that should be included in the list but are missing, I welcome suggestions to enhance the tool's usefulness over time.