July’s release of npm v12 marked a turning point in JavaScript supply chain security. As of this version, dependency lifecycle scripts —preinstall, install, postinstall— and implicit node-gyp builds no longer run unless expressly allowed via an allowScripts block in package.json. This is undoubtedly a major step forward against supply-chain attacks, but it also hands every team a tedious yet critical task: reviewing a list of packages and deciding which ones are safe. The problem is that npm only tells you a package wants to run a script; it does not reveal what that script actually does. A 'postinstall': 'node install.js' is a black box: the answer lives inside install.js, inside the tarball, and in every file it requires. Until now, manually reading those tarballs was the only option. But tools like npm-script-lens have emerged to automate this analysis, and at Q2BSTUDIO we believe their use should become standard in any project that manages npm dependencies.
To illustrate, imagine a typical project depending on sharp, prisma, chalk, and core-js — 39 locked packages in total. Running npx npm-script-lens audit --fail-on-high takes about five seconds (only downloading tarballs for packages with install-time behavior) and returns a clear report: 2 high risks, 0 medium, 2 low, and 35 with no risky behavior. Drilling down, @prisma/engines appears HIGH because its postinstall downloads database engine binaries over the network and spawns processes via execa. sharp is also HIGH because native builds with node-gyp rebuild and pkg-config involve system command execution. core-js, by contrast, only writes a file and reads environment variables —its famous postinstall banner— considered low risk. chalk and 35 other packages have no install-time behavior at all. With this evidence, the team can build a version-pinned allowScripts block, as npm v12 requires, and make informed decisions: {'allowScripts': {'@prisma/engines@5.22.0': false, 'core-js@3.38.1': true, 'prisma@5.22.0': true, 'sharp@0.33.5': false}}.
The real challenge, however, is not the initial audit but upgrades. Approving sharp@0.33.5 today says nothing about sharp@0.34.0 next month. The most sophisticated attacks (like the event-stream incident or this year’s Shai-Hulud wave) are often hijacked releases: a trusted package silently gains a capability its previous version never had. That’s why the --diff mode in tools like npm-script-lens is critical: it compares the current lockfile with the base branch’s and shows exactly what capabilities were added. For example, upgrading sharp from 0.32.6 to 0.33.5 yields: 'gained vs 0.32.6: exec: node-gyp rebuild --directory=src · obf: require()'. That may be a legitimate change (sharp restructured its native build), but it’s exactly the same line a real attack would show. Having that information in a PR comment before approving the upgrade is a security practice no company should overlook.
At Q2BSTUDIO, as a software development and technology company, we have integrated cybersecurity into our development processes for years. When working on custom software projects for our clients, one of the first steps is analyzing the dependency supply chain. npm v12’s new policy forces us to be even more meticulous. But it’s not just about install scripts; we also assess the use of cloud services like AWS or Azure, the implementation of artificial intelligence and AI agents, and the integration of Business Intelligence solutions such as Power BI. Each of these components can introduce risks if not properly audited. For instance, a package downloading binaries from a CDN could be compromised if the cloud provider suffers an attack. That’s why we combine automated tools with manual reviews and advise our clients to adopt a similar approach.
Beyond static capability detection, external verification is essential. Modern tools already cross-check every package against databases like OSV.dev; if a MAL-* advisory appears, it is flagged as KNOWN MALICIOUS and automatically blocked, regardless of script analysis. They also handle obfuscation: eval, new Function, string-built require() calls, and base64/char-code payloads are decoded and re-analyzed, so the report shows what hidden code actually does. This is vital because attackers often conceal their payload.
Keeping the allowScripts block up to date is another challenge. Since entries are version-pinned, every dependency bump silently invalidates previous approvals. To prevent this from becoming operational toil, commands like npm-script-lens sync check if the block has drifted and allow re-pinning while preserving decisions when the new version gained nothing, or flagging when it did. There are also interactive modes (approve) and GitHub Actions that post reports as PR comments. All of this should be part of any project’s CI/CD pipeline to maintain security without sacrificing productivity.
From a business perspective, approving an install script is not binary. A package like @prisma/engines may have 15 million weekly downloads and Sigstore provenance signatures, indicating it is the legitimate Prisma doing its usual work. But a package with the same popularity lacking provenance and having only one maintainer should raise suspicion. The tool provides evidence; the team makes the call. At Q2BSTUDIO, when helping clients adopt cloud services on AWS or Azure, we apply this same level of scrutiny to container images, runtime libraries, and infrastructure-as-code dependencies. Security is not an add-on; it’s part of the design.
Regarding artificial intelligence, AI agents are starting to generate code and manage dependencies autonomously. If an agent adds a package without auditing its install scripts, the risk is enormous. That’s why MCP (Model Context Protocol) servers like npm-script-lens mcp exist, allowing AI agents to audit a package before incorporating it. At Q2BSTUDIO we work with AI agents to automate business processes, but always under human supervision and with automated security controls. Automation should not shortcut security; on the contrary, it should reinforce it.
In short, npm v12 has changed the game. We can no longer ignore what happens during dependency installation. Lifecycle script auditing, done right, protects the entire project ecosystem. Tools like npm-script-lens (MIT license) make this easier, but the ultimate responsibility lies with development teams. At Q2BSTUDIO we understand that technology moves fast, which is why we offer services ranging from developing custom software applications to implementing Business Intelligence with Power BI, plus cybersecurity, cloud, and intelligent automation solutions. If your team is migrating to npm v12 or simply wants to strengthen dependency security, you may need an external perspective and tools like the ones described here. The evidence is available; now it just needs informed approval.
