TL;DR: GitHub is rolling npm 12 in July 2026 with three historically permissive defaults flipped: install scripts blocked, Git dependencies blocked, and remote URL dependencies blocked. The change lands after a wave of high-profile supply chain attacks in the first half of 2026 — 32 malicious packages under @redhat-cloud-services (June 1), a force-pushed malicious commit to codfish/semantic-release-action on June 24 stealing GitHub OIDC tokens and Personal Access Tokens with AES-128-GCM exfiltration, three malicious versions of node-ipc (May 14, 10M weekly downloads), and a @bitwarden/cli impersonation attributed to TeamPCP. Even NC SMBs that "don't do software development" run software supply chain risk through their MSPs, their vendors, their in-house automation, and their Electron/web apps. This is the moment to inventory dependencies, harden CI/CD, and prepare for July 2026 npm defaults.
Key takeaway: In 2026, "we don't write code" is not a valid defense. Every SMB is a downstream software consumer, and every MSP or SaaS vendor upstream of you runs npm, PyPI, or NuGet dependencies. Supply chain breach shifts liability to the party who fails to inventory and monitor — and the FTC Safeguards Rule, HIPAA, and cyber insurance underwriters are increasingly aligned on that view.
Do you know what's in your software supply chain? Contact Preferred Data Corporation for a same-week SBOM and supply chain risk audit. BBB A+ rated. On-site within 200 miles of High Point. Call (336) 886-3282.
What Is Changing in npm 12 in July 2026?
GitHub announced in its "Our plan for a more secure npm supply chain" blog post that npm 12, available from July 2026, will flip three historically permissive defaults. The change represents the largest ecosystem-level shift in npm defaults since the introduction of lockfiles.
Three defaults being flipped:
- Install scripts blocked. The
preinstall,install, andpostinstalllifecycle scripts — the vector for the majority of npm supply chain payloads (including 2021'sua-parser-js, 2022'sevent-stream, and 2026'snode-ipc) — will no longer execute by default. Developers must explicitly allow-list scripts per package. - Git dependencies blocked.
git://andgit+ssh://dependency resolution — a common vector for typosquatting and repo-hijack attacks — is off by default. - Remote URL dependencies blocked. Direct-URL install references (e.g.,
"package": "https://malicious.example/pkg.tgz") are blocked by default.
The migration path is opt-in re-enablement per-project or per-dependency. Any SMB with an in-house Node.js codebase, a Node.js-based CI pipeline, or a build tool that runs npm install will need to audit and either allow-list required scripts or refactor around them by the time developers upgrade.
Key takeaway: npm 12 is the ecosystem's response to a two-year run of catastrophic supply chain attacks. It shifts the default from "assume trust" to "assume adversary." NC SMBs with even a single Node.js internal tool need to plan the upgrade this quarter.
What Happened in the First Half of 2026?
Four major supply chain attacks in the first half of 2026 drove the npm 12 default changes. Understanding each helps size the risk to NC SMBs — even those without direct exposure.
May 14, 2026 — node-ipc malicious versions. Three malicious versions of node-ipc (9.1.6, 9.2.3, 12.0.1) were simultaneously published to npm. node-ipc is a foundational Node.js inter-process communication library with over 10 million weekly downloads. Each malicious version carried an identical 80 KB obfuscated credential-stealing payload injected into the package's CommonJS bundle. Any CI pipeline or Node.js app that resolved to one of the poisoned versions between publication and takedown ran the payload with the privileges of the build user.
June 1, 2026 — @redhat-cloud-services npm namespace. A supply chain attack compromised at least 32 packages published under the @redhat-cloud-services npm namespace. The root cause was a compromised Red Hat employee GitHub account used to push malicious orphan commits to multiple RedHatInsights repositories, bypassing code review entirely. The malware — named "Miasma" by Trend Micro / Hacker News — targeted npm packages and GitHub Actions.
June 24, 2026 — semantic-release-action force push. At 15:39:06 UTC, an attacker force-pushed a malicious commit to codfish/semantic-release-action and redirected several version tags to point at the malicious commit. The payload steals GitHub OIDC tokens, harvests Personal Access Tokens matching known GitHub token patterns, encrypts the collected material with AES-128-GCM, and attempts to propagate a backdoor into other repositories accessible with the stolen credentials. Any GitHub Action workflow using the affected tag range at the time of exploitation ran the payload.
Early 2026 — @bitwarden/cli impersonation (TeamPCP). A malicious npm package published as @bitwarden/cli version 2026.4.0 impersonated the legitimate Bitwarden command-line interface (CLI) password manager. Attribution was made to TeamPCP as part of a broader supply-chain campaign.
Each attack independently demonstrates a class of failure that npm 12 defaults address: install scripts (node-ipc, Miasma), maintainer-account compromise (Miasma, semantic-release-action), and typosquatting/impersonation (Bitwarden CLI).
Why Does This Matter to an NC SMB That "Doesn't Write Code"?
The instinctive reaction — "we don't have developers" — misses the actual attack surface. Even a pure-consumption SMB runs software supply chain risk through five channels.
Five ways NC SMBs are exposed to npm supply chain attacks:
- Your MSP runs Node.js automation. RMM scripts, PowerShell-plus-Node deployment tools, and custom automation are frequently Node.js. Every MSP tenant that runs
npm installinherits the current npm ecosystem posture. - Your SaaS vendors run Node.js and Electron. Slack, Notion, VS Code, Teams, and countless CRMs, quote tools, and helpdesk apps ship Electron builds that pull npm dependencies at build time. A compromised dependency lands in every user's endpoint on next release.
- Your website and marketing tools run Node.js. WordPress plugins, Shopify apps, Webflow custom code, HubSpot workflows, and static-site generators all pull npm dependencies. A compromised marketing site can host malware or exfiltrate PII.
- Your in-house tools use Node.js. Custom quoting tools, reporting dashboards, ERP integrations, and even "just a small script" projects are frequently Node.js. If they run in production, they run production risk.
- Your customers or partners send you code. Consultants, contractors, and vendor integration teams routinely deliver scripts or tools. If those pull npm dependencies, they carry the ecosystem's current risk.
Two 2026 policy shifts make this direct SMB liability:
- FTC Safeguards Rule — Any SMB subject to Safeguards must maintain a written information security program (WISP) that includes third-party service provider oversight. Software supply chain is explicitly in scope. The 2026 civil penalty adjustment is $51,744 per day per violation.
- Cyber insurance underwriting — 2026 policy renewals increasingly require SBOM (Software Bill of Materials), third-party code review evidence, or attestation that the insured monitors software supply chain risk.
How Should NC SMBs Prepare for npm 12?
Even SMBs that consume rather than produce software should execute a three-stage preparation.
Stage 1 — Inventory (this month).
- Ask your MSP for their Node.js dependency inventory. Which of your MSP's automation, RMM, deployment, and monitoring tools run Node.js? Are they pinned to specific versions? Is there an SBOM?
- Ask your SaaS vendors for SBOMs. Microsoft, Slack, Notion, and your CRM should be able to produce an SBOM on request. Any vendor that cannot is a supply chain risk.
- Inventory in-house Node.js apps. Any script, tool, or service that runs
npm installin production is in scope. Include marketing tools, quote generators, and reporting scripts. - Inventory GitHub Actions. Any workflow using third-party actions is exposed to the semantic-release-action class of attack. Prefer pinned SHAs over floating tags.
Stage 2 — Harden (next 30 days).
- Pin dependencies. Move from floating semver ranges (
^1.2.3) to pinned versions (1.2.3) and usepackage-lock.jsonreligiously. - Enable Dependabot or Renovate. Automated PRs on new dependency versions let you evaluate before adopting.
- Enable GitHub Advanced Security. Secret scanning, dependency review, and code scanning give you a signal before a bad release lands.
- Isolate CI runners. Self-hosted GitHub Actions runners should have no ambient credentials to your production environment. GitHub-hosted runners are safer than self-hosted for untrusted workflows.
- Rotate GitHub PATs and OIDC tokens. Assume any PAT touching a compromised repo (semantic-release-action,
@redhat-cloud-services) between June 1 and July 4, 2026 is stolen. Rotate.
Stage 3 — Monitor (ongoing).
- Continuous SBOM. Every production build should emit an SBOM. Store it alongside the release artifact.
- Vulnerability alerting. GitHub Dependabot alerts, Snyk, Semgrep, or Socket.dev catch new CVEs in your dependency tree.
- Behavioral EDR on developer endpoints. Developer laptops running
npm installfor internal tools are P0 endpoints for EDR coverage.
| Control | Addresses | Effort |
|---|---|---|
| Pinned dependencies + lockfile | Silent version drift | 1 week |
| Dependabot/Renovate | Delayed vulnerability disclosure | 1 day |
| GitHub Advanced Security | Secret leakage, dependency risk | 1-2 weeks |
| CI runner isolation | Ambient credential theft | 2-4 weeks |
| Continuous SBOM | Cyber insurance, FTC Safeguards | 2-4 weeks |
| Socket.dev / Snyk | Malicious behavior detection | 1-2 weeks |
| Internal npm registry (Artifactory, Verdaccio) | Zero-day upstream compromise | 4-8 weeks |
Explore Preferred Data's cybersecurity services
What Are the Warning Signs Your Supply Chain Was Hit?
Supply chain compromises leave a consistent forensic fingerprint. Any NC SMB with Node.js exposure should hunt this through July 2026.
High-confidence indicators of compromise:
- CI build durations anomalous. A
npm installstep that suddenly takes 20-40% longer often correlates with malicious install-script payloads doing exfil work. - Outbound connections from CI runners to unfamiliar IPs. Legitimate CI should egress to a small set of well-known destinations. Anything else — bulletproof-hosting ASNs, Tor, or new cloud provider IPs — is a P0 flag.
- GitHub PAT usage from unfamiliar IPs. Review the "Personal access tokens" audit log in every GitHub org. Any PAT used from a non-corporate IP after June 1, 2026 is a rotation candidate.
- New OAuth apps registered against your GitHub org. Post-PAT-theft, attackers register OAuth apps for persistence.
- Endpoints running
npm installshow credential-file access. Look for reads of.git-credentials,.npmrc,~/.aws/credentials,%APPDATA%\Bitwarden, or similar credential stores from Node.js processes.
Lower-confidence but worth reviewing:
- Elevated NPM package audit findings on next
npm audit. - Newly-created branches or force-push events on private repos.
- Team members receiving GitHub verification emails they did not initiate.
If any of these are present, treat as active incident. Isolate CI runners, rotate GitHub PATs and OIDC tokens, review OAuth apps, and escalate to a 24/7 incident response provider.
If you find supply chain IoCs, call Preferred Data at (336) 886-3282 for expedited incident response.
How Does This Connect to the Broader 2026 Threat Pattern?
The 2026 npm supply chain wave fits a consistent pattern: developer-account compromise and force-push tactics targeting the highest-leverage points in the software supply chain. GitLab discovered a widespread npm supply chain attack in the first half of 2026; Trend Micro's Miasma malware analysis, Red Hat's RHSB-2026-006 advisory, and StepSecurity's node-ipc write-up all describe the same class of compromise. Dark Reading's coverage of "Shai-Hulud" supply chain worms in 2026 documents the propagation dynamics.
Three connected 2026 trends every NC SMB should track:
- Maintainer accounts are the target. Attackers no longer need a zero-day in a language runtime; a phished maintainer with commit and publish rights is enough to poison a library used by millions.
- Force-push and tag-redirect are underappreciated. GitHub's protected-branch and tag-protection settings are inconsistently enabled. Force-push attacks work when they should not.
- Install scripts remain the highest-leverage payload delivery. npm 12 defaults address this directly, but Python (
pip install), Ruby (gem install), and Rust (cargo install) have similar exposure and no equivalent defaults.
For NC manufacturers, construction firms, healthcare providers, and professional-services offices in the Piedmont Triad, Charlotte, Raleigh, and Greensboro, software supply chain risk is now a governance and insurance issue as much as a developer issue.
Read Preferred Data's supply chain risk guide
How Does Preferred Data Deliver Supply Chain Defense?
Preferred Data Corporation delivers software supply chain audit, SBOM generation, MSP oversight for developer-tool risk, GitHub configuration hardening, CI/CD isolation, incident response for compromised supply chain, and 24/7 managed detection and response for NC manufacturers, construction firms, healthcare providers, professional-services offices, and financial institutions. With 37+ years of North Carolina IT expertise and an average client retention of 20+ years, our supply chain program integrates with your existing developer, MSP, and insurance controls.
Our npm 12 preparation package includes dependency inventory across in-house and MSP-managed Node.js codebases, SBOM generation aligned with FTC Safeguards and cyber insurance requirements, GitHub Advanced Security enablement, CI runner hardening, phishing-resistant MFA on GitHub accounts, PAT rotation across your organization, and post-June-2026 supply chain incident review.
For businesses within 200 miles of High Point, we deliver on-site support when the situation demands hands-on-keyboard developer engagement.
Review our cybersecurity checklist
Frequently Asked Questions
What is npm 12 and when does it ship?
npm 12 is the next major release of the Node Package Manager, available from July 2026 per GitHub's supply chain security roadmap. It flips three permissive defaults: install scripts blocked, Git dependencies blocked, and remote URL dependencies blocked.
What was the semantic-release-action compromise?
On June 24, 2026 at 15:39:06 UTC, an attacker force-pushed a malicious commit to codfish/semantic-release-action and redirected several version tags. The payload steals GitHub OIDC tokens, harvests Personal Access Tokens matching known GitHub token patterns, encrypts the material with AES-128-GCM, and propagates a backdoor. Any workflow using affected tags is exposed.
What was the @redhat-cloud-services attack?
On June 1, 2026, at least 32 packages under the @redhat-cloud-services npm namespace were poisoned via a compromised Red Hat employee GitHub account. Attackers force-pushed malicious orphan commits to RedHatInsights repositories, bypassing code review. Trend Micro named the malware "Miasma."
We don't have developers. Why does this matter?
Your MSP, SaaS vendors, marketing tools, and any in-house automation almost certainly run npm dependencies. Supply chain compromise cascades to consumers. FTC Safeguards, cyber insurance, and HIPAA vendor management all increasingly treat SBOM and supply chain oversight as required.
What is an SBOM?
Software Bill of Materials — a machine-readable list of every component in a software artifact, with versions and provenance. Cyber insurance renewals in 2026 increasingly require SBOM production for in-house code and evidence of vendor SBOMs for consumed software.
Should we run an internal npm registry?
For SMBs with meaningful in-house Node.js development, yes. Artifactory, Nexus, or Verdaccio proxy the public npm registry and pin package versions. This defends against zero-day upstream compromise where a malicious version reaches the public registry before takedown.
Are Python (pip), Ruby (gem), and Rust (cargo) at similar risk?
Yes. Each ecosystem has had 2024-2026 supply chain incidents. pip in particular has faced a wave of typosquatting and post-install script attacks. The npm 12 default changes are worth studying but do not automatically protect other ecosystems.
Can Preferred Data audit our supply chain this month?
Yes. Our supply chain audit is a 5-10 day engagement for a typical NC SMB and delivers a dependency and SBOM inventory, a GitHub configuration review, a CI/CD hardening plan, and a prioritized remediation roadmap. Call (336) 886-3282 to start the engagement.